{"id":"CVE-2026-115204","kind":"vulnerability","aliases":["CVE-2026-115204"],"related":[],"title":"AZEXO Store Locator WordPress plugin: any logged-in user can run code","description":"The AZEXO Store Locator WordPress plugin through 1.4 does not perform capability or nonce checks on its AJAX actions and does not sanitise a request header used to build a file path, allowing any authenticated user such as a subscriber to write a file with an arbitrary name, location, and content, leading to remote code execution.","summary":"The AZEXO Store Locator WordPress plugin through version 1.4 lets any authenticated user, including a subscriber, write a file with an arbitrary name, location and content. Because the file path is built from an unsanitised request header, an attacker can place a script on the server and run code there.","severity":"high","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["package","self-hosted","wordpress"],"not_affected_if":["plugin-newer-than-1.4","plugin-not-installed"],"how_to_check":"- In WordPress admin under Plugins, find AZEXO Store Locator; version 1.4 or earlier is affected per NVD. If you cannot update, deactivate and remove it.\n- Also look for unexpected new .php files in wp-content and uploads directories, since the flaw writes files with attacker-chosen name and location.","fix":null,"status":"open","published_at":"2026-11-09T07:17:27+00:00","first_seen_at":"2026-11-09T07:25:04+00:00","triaged_at":"2026-11-09T07:25:56+00:00","updated_at":"2026-11-09T07:27:29+00:00","category":"package","confidence":0.5,"triage":{"at":"2026-11-09T07:25:56Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"AZEXO Store Locator WordPress plugin: any logged-in user can run code","impact":"high","summary":"The AZEXO Store Locator WordPress plugin through version 1.4 lets any authenticated user, including a subscriber, write a file with an arbitrary name, location and content. Because the file path is built from an unsanitised request header, an attacker can place a script on the server and run code there.","audience":"businesses","category":"package","nicknames":[],"who_cares":["wordpress","self-hosted"],"confidence":0.6,"fix_status":"unknown","needs_auth":"yes","worst_case":"Attacker runs code on the web server as an authenticated user","analyst_note":"Find the fixed plugin version and the vendor advisory for CVE-2026-115204; the sources give no fix or detection step.","how_to_check":"- Check whether the `AZEXO Store Locator` plugin is installed and its version in the WordPress admin under Plugins.\n- unknown","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["plugin-not-installed","plugin-newer-than-1.4"],"who_is_affected":"Sites running the AZEXO Store Locator plugin at version 1.4 or earlier are exposed. Any account that can log in, including the lowest subscriber role, is enough to trigger the flaw. Sites without the plugin are not affected.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"no","severity_if_unknown":"high"},"cost_usd":0.000722,"input_tokens":4557,"output_tokens":533,"severity_before":"unknown"},"analyst_status":"done","analyst_note":"Find the fixed plugin version and the vendor advisory for CVE-2026-115204; the sources give no fix or detection step.","search":"'-115204':16A,19A '-2026':15A,18A '1.4':33B,81C 'action':92C 'ajax':91C 'allow':106C 'arbitrari':46B,120C 'attack':63B 'authent':36B,108C 'azexo':1A,26B,75C 'build':102C 'built':56B 'capabl':85C 'check':88C 'code':13A,73B,128C 'content':50B,124C 'cve':14A,17A 'execut':129C 'file':43B,53B,104C,117C 'header':61B,99C 'host':23B 'includ':38B 'lead':125C 'let':34B 'locat':3A,28B,48B,77C,122C 'log':8A 'logged-in':7A 'name':47B,121C 'nonc':87C 'packag':20B 'path':54B,105C 'perform':84C 'place':65B 'plugin':5A,30B,79C 'remot':127C 'request':60B,98C 'run':12A,72B 'sanitis':96C 'script':67B 'self':22B 'self-host':21B 'server':70B 'store':2A,27B,76C 'subscrib':40B,113C 'unsanitis':59B 'use':100C 'user':10A,37B,109C 'version':32B 'wordpress':4A,24B,29B,78C 'write':41B,115C","nicknames":[],"mitigations":[],"who_affected":"Sites running the AZEXO Store Locator plugin at version 1.4 or earlier are exposed. Any account that can log in, including the lowest subscriber role, is enough to trigger the flaw. Sites without the plugin are not affected.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["high","package","selfhosted","wordpress"],"campaign_type":null,"search_a":"'-115204':16A,19A '-2026':15A,18A 'azexo':1A 'code':13A 'cve':14A,17A 'locat':3A 'log':8A 'logged-in':7A 'plugin':5A 'run':12A 'store':2A 'user':10A 'wordpress':4A","search_b":"'1.4':33B 'arbitrari':46B 'attack':63B 'authent':36B 'azexo':26B 'built':56B 'code':73B 'content':50B 'file':43B,53B 'header':61B 'host':23B 'includ':38B 'let':34B 'locat':28B,48B 'name':47B 'packag':20B 'path':54B 'place':65B 'plugin':30B 'request':60B 'run':72B 'script':67B 'self':22B 'self-host':21B 'server':70B 'store':27B 'subscrib':40B 'unsanitis':59B 'user':37B 'version':32B 'wordpress':24B,29B 'write':41B","search_c":"'1.4':81C 'action':92C 'ajax':91C 'allow':106C 'arbitrari':120C 'authent':108C 'azexo':75C 'build':102C 'capabl':85C 'check':88C 'code':128C 'content':124C 'execut':129C 'file':104C,117C 'header':99C 'lead':125C 'locat':77C,122C 'name':121C 'nonc':87C 'path':105C 'perform':84C 'plugin':79C 'remot':127C 'request':98C 'sanitis':96C 'store':76C 'subscrib':113C 'use':100C 'user':109C 'wordpress':78C 'write':115C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-09T07:17:27+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-115204","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-115204","severity":null,"published_at":"2026-11-09T07:17:27+00:00","modified_at":"2026-11-09T07:17:27+00:00","first_seen_at":"2026-11-09T07:25:04+00:00","fetched_at":"2026-11-09T07:25:04+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-115204:2256","url":null,"severity":null,"published_at":"2026-11-09T07:27:29+00:00","modified_at":"2026-11-09T07:27:29+00:00","first_seen_at":"2026-11-09T07:27:29+00:00","fetched_at":"2026-11-09T07:27:29+00:00","note":"No primary source read: web-cli out of Exa credits, NVD page via WebFetch returned no content. No vendor advisory or fixed version found; fix left unknown, nothing verified. Revisit when search works: check wordpress.org plugin page/changelog and WPScan for a version above 1.4."}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}