Login Request a demo
High severity · published Dec 12, 2022
CVE-2022-3989
Motors - Car Dealer, Classifieds & Listing < 1.4.4 - Arbitrary File Upload
8.8
CVSS
1.1%
EPSS
No
On KEV
Description
The Motors WordPress plugin before 1.4.4 does not properly validate uploaded files for dangerous file types (such as .php) in an AJAX action, allowing an attacker to sign up on a victim's WordPress instance, upload a malicious PHP file and attempt to launch a brute-force attack to discover the uploaded payload.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)1.1% · higher than 66% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
MC
Motors - Car Dealer, Classifieds & Listing · Stylemixthemes
before 1.4.4 · source: NVD
Affected product
MC
Motors - Car Dealer, Classifieds & Listing
Stylemixthemes
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2022-3989
CVE.org
https://www.cve.org/CVERecord?id=CVE-2022-3989
Exploit
https://wpscan.com/vulnerability/1bd20329-f3a5-466d-81b0-e4ff0ca32091
More from Motors - Car Dealer, Classifieds & Listing
8.8
CVE-2025-2807
Motors – Car Dealership & Classified Listings Plugin <= 1.4.64 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Plugin Installation
8.8
CVE-2022-38716
WordPress Motors – Car Dealer & Classified Ads Plugin <= 1.4.4 is vulnerable to Cross Site Request Forgery (CSRF)
7.5
CVE-2023-46207
WordPress Motors – Car Dealer & Classified Ads Plugin <= 1.4.6 is vulnerable to Server Side Request Forgery (SSRF)
6.5
CVE-2019-17228
includes/options.php in the motors-car-dealership-classified-listings (aka Motors - Car Dealer & Classified Ads) plugin through 1.4.0 for WordPress allows unauthenticated options…
6.1
CVE-2023-46208
WordPress Motors – Car Dealer & Classified Ads Plugin <= 1.4.6 is vulnerable to Cross Site Scripting (XSS)