WP Multi Store Locator Pro (<= 4.5.1) - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/products/wp-multi-store-locator-pro--4.5.1/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioFri, 18 Sep 2026 10:05:12 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgUnauthenticated SQL Injection in WP Multi Store Locator Prohttps://feed.craftedsignal.io/briefs/2026-09-wp-multi-store-locator-sqli/Fri, 18 Sep 2026 10:05:12 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-09-wp-multi-store-locator-sqli/The WP Multi Store Locator Pro plugin for WordPress is vulnerable to unauthenticated SQL injection via the 'store_locatore_search_radius' parameter due to inadequate input sanitization and a lack of prepared statements.The WP Multi Store Locator Pro plugin for WordPress (versions up to and including 4.5.1) contains a critical SQL injection vulnerability identified as CVE-2026-15275. The flaw exists within the 'store_locatore_search_radius' parameter handled by the 'wp_ajax_nopriv_make_search_request' AJAX handler. Because the handler is registered without nonce verification or user capability checks, the endpoint is accessible to unauthenticated remote attackers.

The vulnerability arises because the plugin fails to properly prepare SQL queries or sanitize input before including it in database operations. Specifically, the injection occurs in a numeric, unquoted SQL context, which effectively bypasses WordPress's standard 'wp_magic_quotes()' addslashes-based protection. If exploited, an attacker can append malicious SQL commands to legitimate queries to exfiltrate sensitive data from the WordPress database. This represents a significant risk for organizations running this plugin on internet-facing WordPress instances.

Impact

Successful exploitation allows an unauthenticated remote attacker to perform unauthorized SQL queries against the underlying database. This could result in the exfiltration of sensitive configuration data, user credentials, or administrative information contained within the WordPress database. The scope of impact is potentially any site utilizing versions 4.5.1 or older of the WP Multi Store Locator Pro plugin.

Recommendation

  • Update the WP Multi Store Locator Pro plugin to the latest available version beyond 4.5.1 to remediate CVE-2026-15275.
  • Monitor web server access logs for anomalous requests directed at the WordPress AJAX endpoint related to the 'make_search_request' action.
  • Review database query logs or error logs for SQL syntax errors originating from non-authenticated users.
  • Disable the plugin immediately if an update is not currently available and the site is public-facing.
]]>highadvisory