Arbitrary File Write Vulnerability in AZEXO Store Locator Plugin for WordPress
CVE-2026-115204
Currently unrated
Key Information:
- Vendor
WordPress
- Status
- Vendor
- CVE Published:
- 9 November 2026
Badges
👾 Exploit Exists🟡 Public PoC
What is CVE-2026-115204?
The AZEXO Store Locator plugin for WordPress prior to version 1.4 is vulnerable due to a lack of capability and nonce checks on its AJAX actions. The plugin improperly sanitizes a request header that is utilized for constructing file paths. This oversight allows any authenticated user, including low-privilege users such as subscribers, to write files with arbitrary names, locations, and content, potentially leading to remote code execution.
Affected Version(s)
AZEXO Store Locator 0 <= 1.4
Exploit Proof of Concept (PoC)
PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.