Skip to content
Threat Feed
Subscribe

Product

Store Locator (<= 1.4)

1 brief RSS
high advisory

AZEXO Store Locator: Arbitrary file write and remote code execution (CVE-2026-115204)

The AZEXO Store Locator WordPress plugin through 1.4 fails to perform capability or nonce checks on AJAX actions and lacks sanitization of request headers used for file path construction, allowing authenticated users to perform arbitrary file writes leading to remote code execution.

Store Locator wordpress plugin rce cve-2026-115204
1c