---
id: "CVE-2026-115205"
kind: "vulnerability"
aliases: ["CVE-2026-115205"]
title: "AZEXO Store Locator WordPress plugin lets any logged-in user delete posts"
severity: "high"
cvss: null
epss: null
exploited: false
status: "open"
category: "package"
products: [{"name": "azexo-store-locator", "fixed": [], "affected": "<= 1.4", "ecosystem": "wordpress"}]
ecosystems: []
tags: ["azexo-store-locator", "closed-plugin", "no-fix", "package", "wordpress", "wordpress-plugin"]
not_affected_if: ["plugin-newer-than-1.4", "plugin-not-installed"]
published_at: "2026-11-03T06:17:37+00:00"
first_seen_at: "2026-11-03T06:18:59+00:00"
updated_at: "2026-11-03T06:22:15+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-115205", "first_seen_at": "2026-11-03T06:18:59+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-11-03T06:22:15+00:00"}]
---

# AZEXO Store Locator WordPress plugin lets any logged-in user delete posts

The AZEXO Store Locator WordPress plugin through version 1.4 has no capability check when deleting posts. Any authenticated user, including a subscriber, can delete arbitrary posts and pages on the site.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- wordpress:azexo-store-locator affected <= 1.4 fixed ?

## How to check

- WordPress admin > Plugins: look for AZEXO Store Locator; any installed version (1.4 is the last released) is affected.
- Or check wp-content/plugins/azexo-store-locator/ on disk.
- Check whether the site allows public registration, since any subscriber account can trigger it.

## Fix

No fixed version. WordPress.org closed the plugin on 2026-10-23 (temporary, pending review); latest listed version is 1.4. Deactivate and delete the plugin.

## Timeline

- 2026-11-03T06:18:59+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-115205
- 2026-11-03T06:22:15+00:00 analyst — NVD says through 1.4 and gives no fix. WordPress.org page shows plugin closed 2026-10-23 pending review, version 1.4 is latest (last updated 2020). No vendor advisory, no PoC, no exploitation found. Fix status none from the closure page; the closure is not an advisory so the exploit details are NVD only.

## Documents

- [advisory] AZEXO Store Locator - WordPress.org plugin page (closed) https://wordpress.org/plugins/azexo-store-locator/
- [describes] NVD CVE-2026-115205 https://nvd.nist.gov/vuln/detail/CVE-2026-115205

## From the sources

The AZEXO Store Locator WordPress plugin through 1.4 does not have a capability check or any authorization control when deleting a post, allowing any authenticated user, such as a subscriber, to delete arbitrary posts and pages.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_