AZEXO Store Locator: Arbitrary file write and remote code execution (CVE-2026-115204)
The AZEXO Store Locator WordPress plugin through 1.4 fails to perform capability or nonce checks on AJAX actions and lacks sanitization of request headers used for file path construction, allowing authenticated users to perform arbitrary file writes leading to remote code execution.
CVE search metadata
CVE search record: CVE-2026-115204. Severity: high. CVSS: 8.8. KEV: no. Product: Store Locator (<= 1.4). Brief: AZEXO Store Locator: Arbitrary file write and remote code execution (CVE-2026-115204). Brief link: https://feed.craftedsignal.io/briefs/2026-11-azexo-store-locator-rce/
Triage facts
Revision 1- Applicability
- Store Locator (<= 1.4)
- Evidence
- Unknown
- Severity
- High
- Sources
- 1 public source
- Freshness
- Revision 1Nov 9, 19:56 UTC
- Vulnerabilities
- 1 CVE
- Source quality
- A2Roughly even chance
The AZEXO Store Locator WordPress plugin through 1.4 does not perform capability or nonce checks on its AJAX actions and does not sanitise a request header used to build a file path. This allows an authenticated user, such as a subscriber, to write a file with an arbitrary name, location, and content, leading to remote code execution.