High severity · published May 3, 2025
CVE-2024-13738
Motors - Car Dealer, Rental & Listing WordPress theme <= 5.6.65 - Unauthenticated Arbitrary Shortcode Execution
7.3
CVSS
0.5%
EPSS
No
On KEV
Description
The The Motors - Car Dealer, Rental & Listing WordPress theme theme for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 5.6.65. This is due to the software allowing users to execute an action that does not properly validate a value before running do_shortcode. This makes it possible for unauthenticated attackers to execute arbitrary shortcodes.
*It is unclear exactly which version the issue was patched in from the changelog. Therefore, we used the latest version at the time of verification.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
Low
Integrity
Low
Availability
Low
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.5% · higher than 44% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
MC
Motors - Car Dealer, Rental & Listing WordPress theme · StylemixThemes
through 5.6.65 · source: vendor
Affected product
MC
Motors - Car Dealer, Rental & Listing WordPress theme
StylemixThemes
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2024-13738
CVE.org
https://www.cve.org/CVERecord?id=CVE-2024-13738
stylemixthemes.com
https://stylemixthemes.com/motors/
themeforest.net
https://themeforest.net/item/motors-automotive-cars-vehicle-boat-dealership-classifieds-wordpress-theme/13987211
www.wordfence.com
https://www.wordfence.com/threat-intel/vulnerabilities/id/4635f5c1-c326-4f53-bc54-a402cf5dae00?source=cve
More from Motors - Car Dealer, Rental & Listing WordPress theme
9.8
CVE-2025-4322
Motors <= 5.6.67 - Unauthenticated Privilege Escalation via Password Update/Account Takeover