{"id":"CVE-2026-115204","published":"2026-11-09T07:17:27.353","lastModified":"2026-11-10T16:28:46.510","description":"The AZEXO Store Locator WordPress plugin through 1.4 does not perform capability or nonce checks on its AJAX actions and does not sanitise a request header used to build a file path, allowing any authenticated user such as a subscriber to write a file with an arbitrary name, location, and content, leading to remote code execution.","cvssScore":8.8,"cvssSeverity":"HIGH","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cwes":["CWE-434"],"vendors":[],"products":[],"references":[{"url":"https://wpscan.com/vulnerability/c3c1a344-14ca-4c98-8f00-d38891a97d69/","tags":[]}],"exploitRefs":[],"hasPoc":false,"ai":{"summary":"The AZEXO Store Locator WordPress plugin (≤1.4) lacks capability and nonce validation on AJAX endpoints and fails to sanitize a request header used in file path construction, enabling any authenticated user—including low-privilege subscribers—to write arbitrary files to arbitrary locations on the server, which can lead to remote code execution via web shell upload.","exploitability":"Exploitation requires only valid WordPress authentication (e.g., subscriber-level credentials) and no user interaction; it is straightforward for an attacker with a compromised or low-privilege account.","blast_radius":"Successful exploitation grants full server compromise, including confidentiality, integrity, and availability impacts, potentially affecting all sites hosted on the same server or sharing infrastructure.","remediation":"Upgrade to AZEXO Store Locator plugin version 1.5 or later, which addresses the missing capability checks, nonce verification, and header sanitization flaws.","detection":"Defenders should monitor WordPress debug logs and file system change events for unexpected PHP or web-accessible files (e.g., .php, .phtml) created in non-standard directories such as wp-content/uploads or plugin folders by authenticated users with minimal privileges; also watch for AJAX requests to /wp-admin/admin-ajax.php targeting azexo_store_locator endpoints from low-privilege roles.","tags":["rce","file-upload","auth-bypass","wordpress","ajax","web"],"model":"garnet-coder","analyzedAt":"2026-11-10T09:46:32.122Z"}}