Motors WordPress Plugin Arbitrary File Deletion Vulnerability

A vulnerability allowing arbitrary file deletion has been identified in the Motors – Car Dealership & Classified Listings Plugin for WordPress, affecting all versions through 1.4.107. The issue arises from inadequate validation of file paths in the logo upload process, which allows authenticated users with subscriber-level access or higher to delete arbitrary files from the server.

Impact

Exploitation of this vulnerability could lead to unauthorized deletion of files on the server.

Reproduction

To reproduce this vulnerability, an authenticated user with subscriber-level access or higher can upload a logo through the profile update handler. During this process, the user can specify an arbitrary filesystem path, which the plugin does not properly validate. If the path is within the WordPress uploads directory, it can be used to delete files from the server.

Remediation

Users are advised to update the Motors – Car Dealership & Classified Listings Plugin to version 1.4.108 or a newer patched version.