{"id":"CVE-2026-115205","kind":"vulnerability","aliases":["CVE-2026-115205"],"related":[],"title":"AZEXO Store Locator WordPress plugin lets any logged-in user delete posts","description":"The AZEXO Store Locator WordPress plugin through 1.4 does not have a capability check or any authorization control when deleting a post, allowing any authenticated user, such as a subscriber, to delete arbitrary posts and pages.","summary":"The AZEXO Store Locator WordPress plugin through version 1.4 has no capability check when deleting posts. Any authenticated user, including a subscriber, can delete arbitrary posts and pages on the site.","severity":"high","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"azexo-store-locator","fixed":[],"affected":"<= 1.4","ecosystem":"wordpress"}],"ecosystems":[],"tags":["azexo-store-locator","closed-plugin","no-fix","package","wordpress","wordpress-plugin"],"not_affected_if":["plugin-newer-than-1.4","plugin-not-installed"],"how_to_check":"- WordPress admin > Plugins: look for AZEXO Store Locator; any installed version (1.4 is the last released) is affected.\n- Or check wp-content/plugins/azexo-store-locator/ on disk.\n- Check whether the site allows public registration, since any subscriber account can trigger it.","fix":"No fixed version. WordPress.org closed the plugin on 2026-10-23 (temporary, pending review); latest listed version is 1.4. Deactivate and delete the plugin.","status":"open","published_at":"2026-11-03T06:17:37+00:00","first_seen_at":"2026-11-03T06:18:59+00:00","triaged_at":"2026-11-03T06:20:50+00:00","updated_at":"2026-11-03T06:22:15+00:00","category":"package","confidence":0.8,"triage":{"at":"2026-11-03T06:20:50Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"AZEXO Store Locator WordPress plugin lets any logged-in user delete posts","impact":"medium","summary":"The AZEXO Store Locator WordPress plugin through version 1.4 has no capability check when deleting posts. Any authenticated user, including a subscriber, can delete arbitrary posts and pages on the site.","audience":"businesses","category":"package","nicknames":[],"who_cares":["wordpress","wordpress-plugin","azexo-store-locator"],"confidence":0.6,"fix_status":"unknown","needs_auth":"yes","worst_case":"any logged-in user deletes arbitrary posts and pages","analyst_note":"Confirm the fixed version and whether a patch exists; the NVD entry gives no fix or CVSS score.","how_to_check":"- Check whether the `AZEXO Store Locator` plugin is installed and its version in the WordPress admin under Plugins.\n- Look for the plugin folder in `wp-content/plugins/` and confirm its version is `1.4` or lower.\n- Check whether the site allows public registration, since any account (such as a subscriber) can trigger it.","plain_action":"","needs_analyst":true,"not_affected_if":["plugin-not-installed","plugin-newer-than-1.4"],"who_is_affected":"Sites running the AZEXO Store Locator WordPress plugin version 1.4 or earlier are exposed. Any logged-in user, including the lowest-privilege subscriber role, can delete posts and pages, so sites with open registration are most at risk. Sites without this plugin installed are not affected.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000707,"input_tokens":4094,"output_tokens":595,"severity_before":"unknown"},"analyst_status":"done","analyst_note":"Confirm the fixed version and whether a patch exists; the NVD entry gives no fix or CVSS score.","search":"'-115205':16A,19A '-2026':15A,18A '1.4':47B,77C 'allow':92C 'arbitrari':63B,102C 'authent':56B,94C 'author':86C 'azexo':1A,21A,25B,40B,71C 'azexo-store-loc':24B 'azexo-store-locator':20A 'capabl':50B,82C 'check':51B,83C 'close':29B 'closed-plugin':28B 'control':87C 'cve':14A,17A 'delet':12A,53B,62B,89C,101C 'fix':33B 'includ':58B 'let':6A 'locat':3A,27B,42B,73C 'locator':23A 'log':9A 'logged-in':8A 'no-fix':31B 'packag':34B 'page':66B,105C 'plugin':5A,30B,38B,44B,75C 'post':13A,54B,64B,91C,103C 'site':69B 'store':2A,22A,26B,41B,72C 'subscrib':60B,99C 'user':11A,57B,95C 'version':46B 'wordpress':4A,35B,37B,43B,74C 'wordpress-plugin':36B","nicknames":[],"mitigations":[],"who_affected":"Sites running the AZEXO Store Locator WordPress plugin version 1.4 or earlier are exposed. Any logged-in user, including the lowest-privilege subscriber role, can delete posts and pages, so sites with open registration are most at risk. Sites without this plugin installed are not affected.","tier":"B","verified":{"fix":{"at":"2026-11-03T06:22:15Z","by":"analyst","doc":"https://wordpress.org/plugins/azexo-store-locator/","run_id":1459}},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":["azexostorelocator"],"ptokens":["azexo","locator","store"],"labels":["azexostorelocator","closedplugin","high","nofix","package","wordpress","wordpressplugin"],"first_public_at":"2026-11-03T06:17:37+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-115205","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-115205","severity":null,"published_at":"2026-11-03T06:17:37+00:00","modified_at":"2026-11-03T06:17:37+00:00","first_seen_at":"2026-11-03T06:18:59+00:00","fetched_at":"2026-11-03T06:18:59+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-115205:1459","url":null,"severity":null,"published_at":"2026-11-03T06:22:15+00:00","modified_at":"2026-11-03T06:22:15+00:00","first_seen_at":"2026-11-03T06:22:15+00:00","fetched_at":"2026-11-03T06:22:15+00:00","note":"NVD says through 1.4 and gives no fix. WordPress.org page shows plugin closed 2026-10-23 pending review, version 1.4 is latest (last updated 2020). No vendor advisory, no PoC, no exploitation found. Fix status none from the closure page; the closure is not an advisory so the exploit details are NVD only."}],"documents":[{"id":55978,"url":"https://wordpress.org/plugins/azexo-store-locator/","title":"AZEXO Store Locator - WordPress.org plugin page (closed)","kind":"vendor","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":55979,"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-115205","title":"NVD CVE-2026-115205","kind":"advisory","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"describes","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}