Motors WordPress Vulnerability Exposes Sites to Takeover

A critical arbitrary file upload vulnerability (CVE-2025-64374) in the Motors WordPress theme (<= 5.6.81) allowed logged-in users with Subscriber-level privileges to upload and activate plugins via an AJAX handler that relied on a nonce but lacked a proper current_user_can() permission check. The flaw could lead to full site takeover on affected sites (over 20,000 installations); the issue was patched in Motors 5.6.82 and administrators are strongly advised to update.