CPE
The AZEXO Store Locator WordPress plugin through 1.4 fails to perform capability or nonce checks on AJAX actions and lacks sanitization of request headers used for file path construction, allowing authenticated users to perform arbitrary file writes leading to remote code execution.