What is CVE-2026-91023?

CVE-2026-91023 is a low-severity vulnerability in Motors, classified under Missing Authorization. CVSS score: 3.1/10. Published 2026-10-02.

How severe is CVE-2026-91023?

Low severity. CVSS v3 base score is 3.1 out of 10.

Auth bypass in Motors

CVE-2026-91023

The Motors WordPress plugin before 1.4.124 does not properly verify that a user is authorised to modify a listing before processing one of its listing management actions, allowing authenticated attackers with subscriber-level access and above to set metadata on posts they do not own, including overwriting product prices. Exploitation is possible only when WooCommerce is active and the Motors WordPress plugin before 1.4.124's paid featured-listing option is enabled, neither of which is a default configuration.

Vulnerability class: Broken Access Control

Published 2026-10-02 · last modified 2026-10-02.

CVSS v3 metric

CVSS v3 base score 3.1 (Low). Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N.

EPSS exploit prediction

No EPSS score from FIRST.org yet. New CVEs usually get one within a few days; no score means no signal yet, not low risk. How EPSS works.

Affected products

Motors

Weakness classification (CWE)

CWE-862 — Missing Authorization

References

wpscan.com/vulnerability/c2400c65-5d77-454c-9691-5e664556341b/ (technical-description, exploit, vdb-entry)

Frequently asked questions

What is CVE-2026-91023?: CVE-2026-91023 is a low-severity vulnerability in Motors, classified under Missing Authorization. CVSS score: 3.1/10. Published 2026-10-02.
How severe is CVE-2026-91023?: Low severity. CVSS v3 base score is 3.1 out of 10.