CVE-2026-3892

The Motors – Car Dealership & Classified Listings Plugin plugin for WordPress is vulnerable to arbitrary file deletion in all versions up to, and including, 1.4.107. This is due to insufficient file path validation in the become-dealer logo upload flow. The plugin allows any authenticated user to set an arbitrary filesystem path via the profile update handler. This makes it possible for authenticated attackers, with subscriber level access and above, to delete arbitrary files on the server.

• CWE-73

• https://plugins.trac.wordpress.org/changeset/3505874/
• https://www.wordfence.com/threat-intel/vulnerabilities/id/52cbc6a4-9825-4b26-8653-0c75cf5247c5?source=cve

Published

May 14, 2026

Last Modified

Jun 17, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-3884Versions of the package spin.js before 3.0.0 are vulnerable …6.1
• CVE-2026-3885The WP Shortcodes Plugin — Shortcodes Ultimate plugin for Wo…6.4
• CVE-2026-3888Local privilege escalation in snapd on Linux allows local at…7.8
• CVE-2026-3889Spoofing issue in Thunderbird. This vulnerability was fixed …6.5
• CVE-2026-38891An improper input validation in the gazebo_ros_diff_drive.cp…7.5
• CVE-2026-3891The Pix for WooCommerce plugin for WordPress is vulnerable t…9.8
• CVE-2026-3893The Carlson VASCO-B GNSS Receiver lacks an authentication me…9.4
• CVE-2026-38930OpenRapid RapidCMS v1.3.1 was discovered to contain an authe…6.5
• CVE-2026-38931A stored cross-site scripting (XSS) vulnerability in the /ad…5.4
• CVE-2026-38934Cross Site Request Forgery vulnerability in diskoverdata dis…8.8
• CVE-2026-38935A reflected cross-site scripting (XSS) vulnerability exists …6.1
• CVE-2026-38936A reflected cross-site scripting (XSS) vulnerability exists …6.1