CVE-2025-4322
The Motors theme for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and including, 5.6.67. This is due to the theme not properly validating a user's identity prior to updating their password. This makes it possible for unauthenticated attackers to change arbitrary user passwords, including those of administrators, and leverage that to gain access to their account.
Scoring
- Severity
- CRITICAL
- CVSS base score
- 9.8
- CVSS vector
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- EPSS probability
- 15.65%
- CWE
- CWE-620
- Published
- 2025-05-20
- Last modified
- 2026-04-09
Affected products
- StylemixThemes Motors - Car Dealer, Rental & Listing WordPress theme
- StylemixThemes Motors - Car Dealer, Rental & Listing WordPress theme
Weakness type
Related vulnerabilities
- CVE-2026-86260 — sfturing hosp_order Password Recovery CommonUserController.java modifyPassWord unverified password change
- CVE-2026-85591 — phpMyFAQ before 4.1.8 Authentication Bypass via Unverified Password Change
- CVE-2026-77644 — Critical Bypass Access Control Vulnerability Reported for Windchill Risk and Reliability (WRR) Enterprise Edition
- CVE-2026-76633 — WeGIA < 3.9.2 Authorization Bypass Password Change via alterarSenha
- CVE-2026-73292 — Semaphore UI: CSRF vulnerability on password change endpoint - No CSRF token or password confirmation
- CVE-2026-17599 — Nexus Repository 3 - Unverified Onboarding State on change-admin-password Endpoint
- CVE-2026-15964 — Single Sign On For TNG <= 2.0.0 - Unauthenticated Privilege Escalation via Unverified Password Change
- CVE-2026-12692 — Improper Authentication in Vimesoft's Enterprise Video Platform