CVE Alert: CVE-2025-10494 – stylemix – Motors – Car Dealership & Classified Listings Plugin

Risk verdict

High. Authenticated users with Subscriber+ privileges can delete arbitrary files, potentially enabling remote code execution; urgency depends on any external exploitation signals (not provided here).

Why this matters

A successful abuse could compromise a live site, expose data, or allow defender-busting activity and persistence. Realistic attacker goals include taking control of the web server, inserting web shells, or disabling security controls by removing or replacing critical files.

Most likely attack path

Preconditions: authenticated access at Subscriber+ level; network access to the hosting environment; no user interaction required. The flaw stems from inadequate file path validation when deleting profile pictures, enabling deletion of sensitive server files. If a critical file (e.g., a PHP config file) is deleted, an attacker may trigger remote code execution and move laterally from the web layer to deeper systems.

Who is most exposed

Sites hosting this plugin on self-managed WordPress deployments with staff or agency accounts are at risk, especially where file permissions are lax, or where administrators reuse credentials or lack MFA.

Detection ideas

• Alerts on unexpected deletions in webroot/uploads or profile-related paths.
• Logs showing deletion actions by Subscriber+ accounts outside normal workflow.
• Sudden deletions or replacements of config-like PHP files.
• Post-deletion web requests indicative of payload execution or web shell activity.
• File integrity monitoring triggering on critical file changes.

Mitigation and prioritisation

• Patch to the latest version or vendor-recommended release; apply promptly.
• Enforce least privilege; restrict deletion rights and validate file paths for deletion endpoints.
• Implement application-layer controls (WAF/mod_security) around file-management endpoints.
• Enable MFA for all Subscriber+ accounts; monitor for unusual deletion activity.
• Ensure verified backups and rapid recovery procedures.
• If KEV is true or EPSS ≥ 0.5, treat as priority 1.