WP CarDealer <= 1.2.16 - Unauthenticated Privilege Escalation

The impact of this vulnerability is severe. An unauthenticated attacker can exploit it to gain full administrative control over a WordPress site running an affected version of WP CarDealer. This grants them the ability to modify content, install malicious plugins, steal sensitive data, and potentially compromise the entire system. The attacker could exfiltrate user credentials, financial information, or other confidential data stored on the site. The ease of exploitation, requiring only a crafted registration request, significantly increases the risk of widespread compromise.

Websites utilizing the WP CarDealer plugin, particularly those with limited security hardening or those running older, unpatched versions of WordPress, are at significant risk. Shared hosting environments where multiple websites share the same server are also vulnerable, as a compromise of one site could potentially lead to the compromise of others.

• wordpress / composer / npm:

grep -r 'WP_CarDealer_User::process_register' /var/www/html/wp-content/plugins/wp-cardealer/

• wordpress / composer / npm:

wp plugin list --status=all | grep 'wp-cardealer'

• wordpress / composer / npm:

wp plugin update wp-cardealer --all

1. 2025-12-11Disclosure

   disclosure

1. Reserviert2025-11-27
2. Veröffentlicht2025-12-11
3. Geändert2026-04-08
4. EPSS aktualisiert2026-03-23

The primary mitigation is to immediately upgrade the WP CarDealer plugin to version 1.2.17 or later. If upgrading is not immediately feasible due to compatibility issues or breaking changes, consider temporarily disabling user registration on the WordPress site to prevent new accounts from being created with elevated privileges. Web Application Firewalls (WAFs) configured to inspect registration requests for suspicious role assignments can provide an additional layer of protection. Monitor WordPress logs for unusual registration attempts or changes to user roles.