CVE-2024-13738: Shortcode Execution in Motors WordPress Theme

The impact of this vulnerability is significant, as it allows unauthenticated attackers to execute arbitrary shortcodes on a vulnerable WordPress site. This can lead to a wide range of malicious activities, including defacement of the website, injection of malware, theft of sensitive data (user credentials, database information), and even complete compromise of the server. Attackers could leverage this to gain persistent access and use the compromised site as a launchpad for further attacks against other systems within the network. The lack of authentication required makes this vulnerability particularly concerning, as anyone with access to the internet can potentially exploit it.

1. Reserved2025-01-26
2. Published2025-05-03
3. Modified2025-05-06
4. EPSS updated2026-04-02

The primary mitigation for CVE-2024-13738 is to upgrade the Motors - Car Dealer, Rental & Listing WordPress theme to the latest available version. Since the specific patched version is not explicitly stated, applying the most recent update is crucial. As a temporary workaround, consider implementing a Web Application Firewall (WAF) with rules to block suspicious shortcode usage or restrict access to the shortcode functionality. Regularly scan your WordPress installation for vulnerabilities using a reputable security plugin and ensure all plugins and themes are kept up-to-date.