Unauthenticated Denial of Service Vulnerability in WP Store Locator by WordPress
CVE-2026-94681

5.9MEDIUM

Key Information:

Vendor

WordPress
Status
WP Store Locator
Vendor
CVE Published:
30 September 2026

What is CVE-2026-94681?

The WP Store Locator plugin for WordPress prior to version 3.0.0 is susceptible to an unauthenticated denial of service attack. This vulnerability allows an attacker to disrupt service availability by exploiting specific weaknesses in the plugin, potentially impacting website performance and accessibility for legitimate users. It is essential for users of this plugin to upgrade to the latest version to mitigate the risks associated with this vulnerability.

Affected Version(s)

WP Store Locator < 3.0.0

References

https://patchstack.com/database/wordpress/plugin/wp-store...
vdb-entry

CVSS V3.1

Score:
5.9
Severity:
MEDIUM
Confidentiality:
None
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
High
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

satokan | Patchstack Bug Bounty Program
.