#envatomarket
Thousands of WordPress Sites at Risk as Motors Theme Flaw Enables Admin Account Takeovers #CVE20254322exploit #StylemixThemesMotors
Thousands of WordPress Sites at Risk as Motors Theme Flaw Enables Admin Account Takeovers
  A critical security flaw tracked as CVE-2025-4322 has left a widely used premium WordPress theme exposed to attackers. Cybercriminals have been exploiting this vulnerability in the Motors theme to seize administrator accounts, allowing them to fully compromise websites—modifying information, inserting fake content, and distributing malicious payloads. Developed by StylemixThemes, Motors has become especially popular with automotive websites, recording nearly 22,500 purchases on EnvatoMarket. Security researchers first identified the flaw on May 2, 2025, and a fix was issued with version 5.6.68 on May 14. Users who have updated to this version are protected, while those still running versions up to 5.6.67 remain vulnerable. “This is due to the theme not properly validating a user’s identity prior to updating their password,” Wordfence explained. “This makes it possible for unauthenticated attackers to change arbitrary user passwords, including those of administrators, and leverage that to gain access to their account.” Despite the release of the patch, attacks began surfacing as early as May 20. By June 7, researchers observed widespread exploitation, with Wordfence reporting it had already blocked over 23,000 attack attempts. The firm also shared lists of IP addresses involved in the attacks, many launching thousands of intrusion efforts. “One obvious sign of infection is if a site’s administrator is unable to log in with the correct password as it may have been changed as a result of this vulnerability,” the researchers explained. To secure their sites, users of the Motors theme are strongly advised to upgrade to version 5.6.68 immediately, which addresses the flaw and prevents further account takeovers.
dlvr.it
July 1, 2025 at 5:57 PM
Hey @EnvatoMarket, I bought a template but I can't download it. It always says that the browser could not find the web server.
November 4, 2024 at 2:58 AM
.@EnvatoMarket if volumes become too high, hire reviewers or close categories - don't leave authors your hanging.. 😩
November 17, 2024 at 7:31 PM
Logging in the @EnvatoMarket forums these days..
November 17, 2024 at 7:31 PM
Just updated my @EnvatoMarket `Neat` template wiht a @gulpjs file that serves your dev environment in @Browsersync:
November 17, 2024 at 7:24 PM
So disappointed in the way @EnvatoMarket is evolving. What used to feel like a big family is now steamrolling over us hard working authors..
November 17, 2024 at 7:24 PM
Just updated a 2-year-old HTML template on @EnvatoMarket. now includes dev workflow (jade/gulp/autoprefx/sourcemaps)
November 17, 2024 at 7:23 PM
My #MODX theme #Booom! is part of the incredible @EnvatoMarket birthday bundle. Save $970 and score incredible assets
November 17, 2024 at 7:15 PM
Took me 1 year to reach 1,000 sales on @EnvatoMarket. The #EnvatoMarketBundle is gunning for 3,000 sales in... 1 DAY!
November 17, 2024 at 7:15 PM
So... the winning logo for "Queen" Romana's "QRTRV News", which was supposed to be original and from the heart turns out to be the demo screenshot from a video for sale on @EnvatoMarket with a Microsoft Word WordArt "QRTRV" pasted on it.

1/2

@HRMQR #RomanaDidulo
November 26, 2024 at 7:33 PM