What is GHSA-6xrf-25hf-gfpv?

GHSA-6xrf-25hf-gfpv is a security advisory published by GitHub Security Advisories with Medium severity. The Motors WordPress plugin before 1.4.110 does not have proper authorisation and CSRF checks on...

Which CVE IDs does GHSA-6xrf-25hf-gfpv cover?

GHSA-6xrf-25hf-gfpv covers the following CVE IDs: CVE-2026-7859. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-6xrf-25hf-gfpv?

GHSA-6xrf-25hf-gfpv has a CVSS v3 base score of 5.3, published by GitHub Security Advisories.

GHSA-6xrf-25hf-gfpvMediumCVSS 5.3

The Motors WordPress plugin before 1.4.110 does not have proper authorisation and CSRF checks on...

Vendor

GitHub Security Advisories

Published

June 22, 2026

Last Modified

June 22, 2026

🔗 CVE IDs covered (1)

CVE-2026-7859 →

📋 Description

The Motors WordPress plugin before 1.4.110 does not have proper authorisation and CSRF checks on one of its AJAX actions, allowing unauthenticated attackers to modify arbitrary post metadata, such as the gallery, featured image and, on WooCommerce sites, product prices.

🔗 References (3)

https://nvd.nist.gov/vuln/detail/CVE-2026-7859
https://wpscan.com/vulnerability/3c11e490-92d8-46e1-a0ae-7c4c703ac411
https://github.com/advisories/GHSA-6xrf-25hf-gfpv