CVE-2026-115204 · Package
NO FIX YET
The AZEXO Store Locator WordPress plugin through version 1.4 lets any authenticated user, including a subscriber, write a file with an arbitrary name, location and content. Because the file path is built from an unsanitised request header, an attacker can place a script on the server and run code there.
first public Nov 9, 2026 · 2 sources
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Sites running the AZEXO Store Locator plugin at version 1.4 or earlier are exposed. Any account that can log in, including the lowest subscriber role, is enough to trigger the flaw. Sites without the plugin are not affected.
Not affected if plugin-newer-than-1.4, plugin-not-installed
Who cares self-hosted, wordpress
No fix yet, per the sources.
The AZEXO Store Locator WordPress plugin through 1.4 does not perform capability or nonce checks on its AJAX actions and does not sanitise a request header used to build a file path, allowing any authenticated user such as a subscriber to write a file with an arbitrary name, location, and content, leading to remote code execution.
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.