CVE-2026-115204

Summary

The AZEXO Store Locator WordPress plugin (≤1.4) lacks capability and nonce validation on AJAX endpoints and fails to sanitize a request header used in file path construction, enabling any authenticated user—including low-privilege subscribers—to write arbitrary files to arbitrary locations on the server, which can lead to remote code execution via web shell upload.

Exploitability

Exploitation requires only valid WordPress authentication (e.g., subscriber-level credentials) and no user interaction; it is straightforward for an attacker with a compromised or low-privilege account.

Blast radius

Successful exploitation grants full server compromise, including confidentiality, integrity, and availability impacts, potentially affecting all sites hosted on the same server or sharing infrastructure.

Detection

Defenders should monitor WordPress debug logs and file system change events for unexpected PHP or web-accessible files (e.g., .php, .phtml) created in non-standard directories such as wp-content/uploads or plugin folders by authenticated users with minimal privileges; also watch for AJAX requests to /wp-admin/admin-ajax.php targeting azexo_store_locator endpoints from low-privilege roles.

Prioritized remediation

Upgrade to AZEXO Store Locator plugin version 1.5 or later, which addresses the missing capability checks, nonce verification, and header sanitization flaws.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.