Live › vulnerability › CVE-2026-115205
The AZEXO Store Locator WordPress plugin through version 1.4 has no capability check when deleting posts. Any authenticated user, including a subscriber, can delete arbitrary posts and pages on the site.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-11-03 06:18 UTC. All times on this page are UTC.
Sites running the AZEXO Store Locator WordPress plugin version 1.4 or earlier are exposed. Any logged-in user, including the lowest-privilege subscriber role, can delete posts and pages, so sites with open registration are most at risk. Sites without this plugin installed are not affected.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| azexo-store-locator | wordpress | <= 1.4 | – |
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
The AZEXO Store Locator WordPress plugin through 1.4 does not have a capability check or any authorization control when deleting a post, allowing any authenticated user, such as a subscriber, to delete arbitrary posts and pages.
This page as .md · .json · in your agent: get_signal("CVE-2026-115205")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.