CVE-2024-5545 Motors – Car Dealer, Classifieds & Listing <= 1.4.9 - Missing Authorization

What is CVE-2024-5545?

CVE-2024-5545 is a medium-severity missing authorization vulnerability in stylemix Motors – Car Dealership & Classified Listings Plugin, published on 2 Jul 2024. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

The Motors – Car Dealer, Classifieds & Listing plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the stm_edit_delete_user_car function in all versions up to, and including, 1.4.8. This makes it possible for unauthenticated attackers to unpublish arbitrary posts and pages.

Weakness: CWE-862

Which versions are affected by CVE-2024-5545?

It affects 1 product.

Products include Stylemixthemes Motors - Car Dealer\, Classifieds \& Listing.

How do I fix CVE-2024-5545?

No fix has been published for CVE-2024-5545 yet. Limit exposure of the affected software until one is available.

Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.

Is CVE-2024-5545 being exploited?

There is no known exploitation of CVE-2024-5545 in the wild and no public exploit code.

Other vulnerabilities in stylemix Motors – Car Dealership & Classified Listings Plugin

• CVE-2025-2807 Missing authorization in Motors – Car Dealership & Classified Listings Plugin High 8.8
• CVE-2022-3989 Motors - Car Dealer, Classifieds & Listing < 1.4.4 - Arbitrary File Upload High 8.8
• CVE-2023-46208 WordPress Motors – Car Dealer & Classified Ads Plugin <= 1.4.6 is vulnerable to Cross Site Scripting (XSS) High 7.1
• CVE-2019-17228 Missing authorization in n/a Medium 6.5
• CVE-2019-17229 Cross-site scripting in n/a Medium 6.1

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-w5g9-fxf7-88qg.