Arbitrary File Upload Vulnerability in DocoDoco Store Locator Plugin for WordPress

CVE-2025-10754

What is CVE-2025-10754?

The DocoDoco Store Locator plugin for WordPress is susceptible to an arbitrary file upload vulnerability due to inadequate file type validation in the zip upload feature. This weakness allows authenticated users with Editor-level permissions and above to bypass security measures. Consequently, these users can upload potentially malicious files to the server, raising the risk of remote code execution and compromising the integrity of the affected WordPress site. Upgrading to the latest version is essential to mitigate this risk.

References