Most recent entries from all https://db.gcve.eu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Tue, 10 Nov 2026 08:11:53 +0000 CVE-2026-104746 — Motors <= 1.4.125 - Authenticated (Subscriber+) Arbitrary File Deletion via 'stm_user_avatar_path' User Meta https://db.gcve.eu/vuln/cve-2026-104746 <p><strong>Affected:</strong> stylemix Motors – Car Dealership &amp; Classified Listings Plugin</p> <p>The Motors – Car Dealership &amp; Classified Listings Plugin plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the stm_listings_ajax_save_user_data function in all versions up to, and including, 1.4.125 This makes it possible for authenticated attackers, with subscriber-level access and above, to delete arbitrary files on the server, which can easily lead to remote code execution when the right file is deleted (such as wp-config.php). Although deletion is bounded to wp-content/uploads (preventing removal of wp-config.php), any authenticated Subscriber can trivially exploit this because the required AJAX nonce is printed on every front-end page and the handler&#39;s stm_user_avatar_path meta is writable by any logged-in user against their own account.</p> <p><strong>Affected:</strong> stylemix Motors – Car Dealership &amp; Classified Listings Plugin</p> <p>The Motors – Car Dealership &amp; Classified Listings Plugin plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the stm_listings_ajax_save_user_data function in all versions up to, and including, 1.4.125 This makes it possible for authenticated attackers, with subscriber-level access and above, to delete arbitrary files on the server, which can easily lead to remote code execution when the right file is deleted (such as wp-config.php). Although deletion is bounded to wp-content/uploads (preventing removal of wp-config.php), any authenticated Subscriber can trivially exploit this because the required AJAX nonce is printed on every front-end page and the handler&#39;s stm_user_avatar_path meta is writable by any logged-in user against their own account.</p> https://db.gcve.eu/vuln/cve-2026-104746