---
id: CVE-2026-105971
title: >-
  Car Dealer <= 4.73 - Unauthenticated Private/Draft/Pending Post Content
  Disclosure via cardealer_single_car_ajax
summary: >-
  The Car Dealer (Dealership) and Vehicle sales WordPress plugin through 4.73
  does not restrict its unauthenticated single-listing AJAX action to published
  content, allowing an unauthenticated attacker to read the title, content and
  metada…
severity: medium
cvss: 5.3
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N'
cvssSource: adp
cwe:
  - CWE-200
product: Car Dealer (Dealership) and Vehicle sales
affected:
  - car_dealer_dealership_and_vehicle_sales <= 4.73
ssvc:
  exploitation: none
  automatable: 'yes'
  technicalImpact: partial
  timestamp: '2026-11-06T11:54:32.484184Z'
published: '2026-11-05'
updated: '2026-11-06'
sourceUpdated: '2026-11-06T12:08:00.393Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-105971'
references:
  - url: 'https://wpscan.com/vulnerability/fd2f5dbc-3a93-47d0-8941-3147e85d5d16/'
tags:
  - cve.org
epss: 0.00206
epssPercentile: 0.10724
ingestedAt: '2026-11-05T21:36:00.789Z'
---

## Overview

The Car Dealer (Dealership) and Vehicle sales WordPress plugin through 4.73 does not restrict its unauthenticated single-listing AJAX action to published content, allowing an unauthenticated attacker to read the title, content and metadata of any private, draft, pending, future or trashed post by supplying its numeric id.

## Affected

- `car_dealer_dealership_and_vehicle_sales <= 4.73`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.