Summary
CVE-2026-54814 is a high-severity PHP Local File Inclusion (LFI) vulnerability in the StylemixThemes Motors WordPress plugin, affecting all versions up to and including 1.4.109. The flaw stems from improper control of filenames used in PHP include/require statements (CWE-98), and is exploitable by unauthenticated remote attackers under specific server conditions. The vulnerability carries a CVSS v3.1 score of 8.1 (HIGH), with Confidentiality, Integrity, and Availability all rated HIGH.
Technical details
-
Root cause: The plugin fails to properly sanitize or validate user-supplied input before passing it to PHP
include/requirestatements, classified under CWE-98 (Improper Control of Filename for Include/Require Statement in PHP Program). This allows an attacker to manipulate the filename parameter to reference arbitrary files on the server’s filesystem. -
Trigger conditions: Exploitable remotely over the network with no user interaction required; Attack Complexity is rated HIGH (AC:H), indicating that specific non-default server conditions or configurations must be present for successful exploitation.
-
Attack vector: Network-accessible (AV:N); no authentication or user interaction required.
-
Impact: Successful exploitation can allow an attacker to read arbitrary local files from the server — including sensitive configuration files such as
wp-config.php, which contains database credentials — potentially enabling complete database compromise. In certain conditions, LFI can further be chained into Remote Code Execution (RCE) through techniques such as log poisoning or inclusion of previously uploaded malicious files.
Affected software
- StylemixThemes Motors WordPress Plugin (
motors-car-dealership-classified-listings): all versions up to and including 1.4.109
Severity
-
CVSS v3.1 Base Score: 8.1 (HIGH)
-
Vector string:
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Mitigation and recommended actions
-
Immediate: Update the Motors plugin to version 1.4.110 or later, which contains the vendor-provided security fix.
-
If immediate patching is not possible, consider temporarily disabling the Motors plugin or restricting external access to the affected WordPress installation until the update can be applied.
-
Review server-side PHP error and access logs for any unusual file inclusion activity or attempts to access sensitive files such as
wp-config.php.
IONIX Status
The IONIX research team is tracking ongoing exploitation attempts and recommends immediate patching. Potentially affected assets are outlined in this post.

