{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/cpes/cpe2.3aazexostore_locator/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:azexo:store_locator:*:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":8.8,"id":"CVE-2026-115204"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["Store Locator (\u003c= 1.4)"],"_cs_severities":["high"],"_cs_tags":["wordpress","plugin","rce","cve-2026-115204"],"_cs_type":"advisory","_cs_vendors":["AZEXO"],"content_html":"\u003cp\u003eThe AZEXO Store Locator WordPress plugin through 1.4 does not perform capability or nonce checks on its AJAX actions and does not sanitise a request header used to build a file path. This allows an authenticated user, such as a subscriber, to write a file with an arbitrary name, location, and content, leading to remote code execution.\u003c/p\u003e\n","date_modified":"2026-11-09T19:56:37Z","date_published":"2026-11-09T19:56:37Z","id":"https://feed.craftedsignal.io/briefs/2026-11-azexo-store-locator-rce/","summary":"The AZEXO Store Locator WordPress plugin through 1.4 fails to perform capability or nonce checks on AJAX actions and lacks sanitization of request headers used for file path construction, allowing authenticated users to perform arbitrary file writes leading to remote code execution.","title":"AZEXO Store Locator: Arbitrary file write and remote code execution (CVE-2026-115204)","url":"https://feed.craftedsignal.io/briefs/2026-11-azexo-store-locator-rce/"}],"language":"en","title":"CraftedSignal Threat Feed - Cpe:2.3:a:azexo:store_locator:*:*:*:*:*:*:*:*","version":"https://jsonfeed.org/version/1.1"}