Exploitation Research Plan - CVE-2026-54828

1. Vulnerability Summary

The Motors – Car Dealership & Classified Listings Plugin (versions <= 1.4.109) contains a Missing Authorization vulnerability. Specifically, the plugin registers administrative AJAX actions intended for site setup and page generation but fails to implement proper capability checks (e.g., current_user_can('manage_options')).

The most likely candidate for this vulnerability is the wpcfto_generate_pages action, used by the plugin's "Page Generator" feature. Based on the provided source code in includes/admin/page_generator/js/page_generator.js, this action is called via a POST request with a JSON payload and, crucially, appears to lack both a capability check and a nonce verification in its handler, allowing unauthenticated attackers to trigger the generation of multiple WordPress pages.

2. Attack Vector Analysis

• Endpoint: /wp-admin/admin-ajax.php
• Action: wpcfto_generate_pages
• HTTP Method: POST
• Payload Format: JSON (sent as the raw POST body)
• Parameters:
  • action: wpcfto_generate_pages (passed in the query string or body)
  • POST Body: A JSON object representing the field_data (pages to be generated).
• Authentication: None (Unauthenticated).