CVE-2025-4322
CRITICAL EXPLOITED NUCLEIMotors WordPress <5.6.67 - Privilege Escalation
Title source: llmDescription
The Motors theme for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and including, 5.6.67. This is due to the theme not properly validating a user's identity prior to updating their password. This makes it possible for unauthenticated attackers to change arbitrary user passwords, including those of administrators, and leverage that to gain access to their account.
Exploits (5)
nomisec
SUSPICIOUS
2 stars
by IndominusRexes · poc
https://github.com/IndominusRexes/CVE-2025-4322-Exploit
Nuclei Templates (1)
Motors <= 5.6.67 - Unauthenticated Privilege Escalation via Password Update/Account Takeover
CRITICALby DhiyaneshDK
FOFA:
body="/wp-content/themes/motors/style.css"
Scores
CVSS v3
9.8
EPSS
0.3114
EPSS Percentile
96.8%
Attack Vector
NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Details
VulnCheck KEV
2025-05-19
CWE
CWE-620
Status
published
Products (1)
StylemixThemes/Motors - Car Dealer, Rental & Listing WordPress theme
< 5.6.67
Published
May 20, 2025
Tracked Since
Feb 18, 2026