{"id":"CVE-2026-124263","kind":"vulnerability","aliases":["CVE-2026-124263"],"related":[],"title":"Locatoraid Store Locator: CSRF flaw lets attackers act as logged-in admins","description":"Cross-Site Request Forgery (CSRF) vulnerability in plainware Locatoraid Store Locator locatoraid allows Cross Site Request Forgery.This issue affects Locatoraid Store Locator: from n/a through 3.9.75.","summary":"The Locatoraid Store Locator WordPress plugin, by plainware, has a cross-site request forgery flaw affecting versions through 3.9.75. An attacker can trick a logged-in administrator's browser into sending unwanted requests to the plugin.","severity":"medium","cvss":5.4,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["locatoraid","package","store-locator","wordpress"],"not_affected_if":["plugin-not-installed"],"how_to_check":"- Check the installed plugin version in the WordPress admin under Plugins, or in the plugin's main file header.\n- Treat any version through `3.9.75` as affected.","fix":null,"status":"open","published_at":"2026-11-11T13:17:18+00:00","first_seen_at":"2026-11-11T13:27:12+00:00","triaged_at":"2026-11-11T13:29:25+00:00","updated_at":"2026-11-11T13:29:25+00:00","category":"package","confidence":0.5,"triage":{"at":"2026-11-11T13:29:25Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"Locatoraid Store Locator: CSRF flaw lets attackers act as logged-in admins","impact":"medium","summary":"The Locatoraid Store Locator WordPress plugin, by plainware, has a cross-site request forgery flaw affecting versions through 3.9.75. An attacker can trick a logged-in administrator's browser into sending unwanted requests to the plugin.","audience":"businesses","category":"package","nicknames":[],"who_cares":["wordpress","locatoraid","store-locator"],"confidence":0.5,"fix_status":"unknown","needs_auth":"unknown","worst_case":"attacker changes plugin settings via a logged-in admin's browser","analyst_note":"Confirm the fixed version and affected plugin path from the vendor or WordPress.org advisory; the NVD entry gives only 'through 3.9.75'.","how_to_check":"- Check the installed plugin version in the WordPress admin under Plugins, or in the plugin's main file header.\n- Treat any version through `3.9.75` as affected.","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["plugin-not-installed"],"who_is_affected":"Sites running the Locatoraid Store Locator plugin through version 3.9.75 are affected, since the flaw is in the plugin's request handling. The sources do not say which configurations or user roles are required, so the exposure level is unknown. Sites that do not run this plugin can skip it.","user_interaction":"yes","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.00073,"input_tokens":4553,"output_tokens":550,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-124263':16A,19A '-2026':15A,18A '3.9.75':45B,90C 'act':8A 'admin':13A 'administr':54B 'affect':42B,83C 'allow':77C 'attack':7A,47B 'browser':56B 'cross':37B,65C,78C 'cross-sit':36B,64C 'csrf':4A,69C 'cve':14A,17A 'flaw':5A,41B 'forgeri':40B,68C 'forgery.this':81C 'issu':82C 'let':6A 'locat':3A,24B,29B,75C,86C 'locatoraid':1A,20B,27B,73C,76C,84C 'log':11A,52B 'logged-in':10A,51B 'n/a':88C 'packag':21B 'plainwar':33B,72C 'plugin':31B,63B 'request':39B,60B,67C,80C 'send':58B 'site':38B,66C,79C 'store':2A,23B,28B,74C,85C 'store-loc':22B 'trick':49B 'unwant':59B 'version':43B 'vulner':70C 'wordpress':25B,30B","nicknames":[],"mitigations":[],"who_affected":"Sites running the Locatoraid Store Locator plugin through version 3.9.75 are affected, since the flaw is in the plugin's request handling. The sources do not say which configurations or user roles are required, so the exposure level is unknown. Sites that do not run this plugin can skip it.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["locatoraid","medium","package","storelocator","wordpress"],"campaign_type":null,"search_a":"'-124263':16A,19A '-2026':15A,18A 'act':8A 'admin':13A 'attack':7A 'csrf':4A 'cve':14A,17A 'flaw':5A 'let':6A 'locat':3A 'locatoraid':1A 'log':11A 'logged-in':10A 'store':2A","search_b":"'3.9.75':45B 'administr':54B 'affect':42B 'attack':47B 'browser':56B 'cross':37B 'cross-sit':36B 'flaw':41B 'forgeri':40B 'locat':24B,29B 'locatoraid':20B,27B 'log':52B 'logged-in':51B 'packag':21B 'plainwar':33B 'plugin':31B,63B 'request':39B,60B 'send':58B 'site':38B 'store':23B,28B 'store-loc':22B 'trick':49B 'unwant':59B 'version':43B 'wordpress':25B,30B","search_c":"'3.9.75':90C 'affect':83C 'allow':77C 'cross':65C,78C 'cross-sit':64C 'csrf':69C 'forgeri':68C 'forgery.this':81C 'issu':82C 'locat':75C,86C 'locatoraid':73C,76C,84C 'n/a':88C 'plainwar':72C 'request':67C,80C 'site':66C,79C 'store':74C,85C 'vulner':70C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-11T13:17:18+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L","cvss_by":"audit@patchstack.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-124263","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-124263","severity":null,"published_at":"2026-11-11T13:17:18+00:00","modified_at":"2026-11-11T13:17:18+00:00","first_seen_at":"2026-11-11T13:27:12+00:00","fetched_at":"2026-11-11T13:27:12+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}