Arbitrary File Upload Vulnerability in Agile Logix Store Locator by WordPress
CVE-2025-49329

6.6MEDIUM

Key Information:

Vendor

WordPress
Status
Store Locator WordPress
Vendor
CVE Published:
6 June 2025

What is CVE-2025-49329?

The Agile Logix Store Locator plugin for WordPress has a vulnerability that allows an attacker to upload a web shell to the server. This issue permits the uploading of files that could execute malicious scripts, potentially compromising the integrity of the server. Users of versions from n/a to 1.5.2 should ensure they update to the latest version to protect their applications from unauthorized file access and related threats.

Affected Version(s)

Store Locator WordPress <= 1.5.2

References

https://patchstack.com/database/wordpress/plugin/agile-st...
vdb-entry

CVSS V3.1

Score:
6.6
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
High
User Interaction:
None
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Nguyen Kim Sang (Patchstack Alliance)
.