CVE-2026-54814: WordPress Motors plugin <= 1.4.109 - Local File Inclusion vulnerability

Synopsis

A Local File Inclusion vulnerability affects the StylemixThemes Motors WordPress plugin at version 1.4.109 and earlier. The flaw is reachable over the network without any authentication, though exploitation requires meeting specific conditions that make it less than trivially repeatable. A successful attacker can read sensitive files from the server, tamper with application data, and disrupt service availability, achieving full confidentiality, integrity, and availability impact on the affected host. HarborGuard is tracking the advisory for patch availability, as no fix version has been published yet.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The vulnerable endpoint is exposed over the network, so an attacker must be able to reach the WordPress instance via HTTP or HTTPS to attempt exploitation.

• AuthenticationNot required

  No account or session credential is needed; the attacker can trigger the inclusion flaw as an unauthenticated visitor.

• Victim interactionNot required

  The attacker does not need to trick or involve any user; exploitation is driven entirely by the attacker's own requests.

• Attack complexityDetail

  Complexity is rated High, meaning the attacker must satisfy specific environmental or configuration conditions, such as a particular server setup or race condition, rather than firing a simple, always-reliable exploit.

Blast Radius

• A successful attacker can read arbitrary files from the server filesystem, exposing WordPress configuration files, database credentials, and private application secrets.
• The attacker can tamper with application state or inject malicious PHP by leveraging the inclusion primitive, modifying persisted content or introducing backdoors.
• Full service disruption is within reach, allowing the attacker to crash or destabilize the WordPress instance and make it unavailable to legitimate users.
• If the web server process has broad filesystem permissions, the blast radius extends beyond the WordPress installation to other files and services co-located on the same host.