CVE-2026-116617stylemix Motors path traversal

What it is

A file name from the request can climb out of the intended folder with sequences like ../, reaching files the service never meant to expose.

How it is reached

An attacker can exploit it over the network, with an ordinary user account, and nobody has to click anything.

What an attacker gains

A successful attack can change data or behaviour and take it offline. In practice, this kind of flaw lets an attacker read or write files outside the folders the service meant to expose.

Is it being exploited?

There is no public report of exploitation yet. EPSS estimates a 0.49% chance of exploitation activity in the next 30 days, higher than 43% of scored CVEs.

What to do

1. No fixed version is listed yet. Find every place stylemix Motors runs, watch the references for a fix, and plan a replacement if it is no longer supported.
2. While there is no fix, review who holds accounts that can reach it.

Description from NVD

The Motors – Car Dealership & Classified Listings Plugin plugin for WordPress is vulnerable to File Deletion in all versions up to, and including, 1.4.128 The vulnerability exists because `stm_save_user_extra_fields()`, hooked to `personal_options_update`, writes the attacker-controlled `stm_dealer_logo_path` parameter directly to user meta without an ownership check binding the submitted path to the submitting user — unlike the `stm_payment_status` and `stm_lost_password_hash` fields, this field is not gated by a `manage_options` or `edit_users` capability check. This makes it possible for authenticated attackers, with Subscriber-level access and above, to delete image files belonging to other users under `wp-content/uploads` — including other users' avatars, dealer logos, and uploaded media — by storing a crafted path via their own profile and then triggering `unlink()` through the become-dealer form on their author page. Note that the two path guards (`stm_mvl_is_path_within_uploads` and `stm_mvl_is_allowed_image_file`) do restrict the attack surface to files with an image extension that resolve within the uploads basedir; files outside that directory, such as `wp-config.php` or plugin PHP files, cannot be reached.