The Motors theme for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and including, 5.6.67. This is due to the theme not properly validating a user's identity prior to updating their password. This makes it possible for unauthenticated attackers to change arbitrary user passwords, including those of administrators, and leverage that to gain access to their account.
The Motors theme does not properly verify user identity before performing password change operations. An attacker without any permissions can invoke an appropriate theme function and change the password of any account, including WordPress administrator accounts. After changing the password, the attacker logs into the compromised account and gains full access to the administrative panel.
An attacker can take full control of a WordPress administrator account, which in practice means the ability to modify the website, install malicious plugins or backdoors, steal data, and compromise the entire hosting server.
The Motors theme should be immediately updated to a version higher than 5.6.67. Patches are available from the theme developer on the ThemeForest platform. Until the update is applied, it is recommended to restrict access to the website or temporarily disable the theme.
The Motors theme for WordPress in all versions up to and including 5.6.67.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H