CVE-2026-115204

HighCVSS 8.8/10Last modified Nov 10, 2026

Description

The AZEXO Store Locator WordPress plugin through 1.4 does not perform capability or nonce checks on its AJAX actions and does not sanitise a request header used to build a file path, allowing any authenticated user such as a subscriber to write a file with an arbitrary name, location, and content, leading to remote code execution.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-434

Affected software

Vendor	Product	Versions
Unknown	AZEXO Store Locator	<= 1.4

References

https://wpscan.com/vulnerability/c3c1a344-14ca-4c98-8f00-d38891a97d69/

Timeline

Published: Nov 9, 2026
Last modified: Nov 10, 2026
NVD status: Deferred

Related CVEs from 2026

CVE-2026-1152056.5The AZEXO Store Locator WordPress plugin through 1.4 does not have a capability check or any authorization control when deleting a post, all CVE-2026-1152075.5A flaw was found in GNU patch. An attacker can achieve arbitrary file creation outside the intended working directory by enticing a user or CVE-2026-115216.3A security vulnerability has been detected in Mohammed-eid35 bank-management-system-springboot up to 7b9bcc65ad7df3db29af71aed9bb500e5f24d94 CVE-2026-1152128.8The mView 豆瓣电影 WordPress plugin through 1.0.3 does not validate the type, name, or source of a remotely fetched file, nor perform any capabi CVE-2026-1152139.8The EASY-JS-WPAPI Client HANDLE for the WordPress REST-API WordPress plugin through 2.0 does not prevent the administrator credentials it st CVE-2026-1152149.8The Datawiza Proxy Auth Plugin WordPress plugin before 1.1.1 does not verify that the user-identity and role HTTP request headers it trusts CVE-2026-1152158.7In Eclipse ThreadX NetX Duo versions 6.0 through 6.5.2.202603a, the NetX Secure DTLS server allocates a session from its fixed session pool CVE-2026-1152169.1In Eclipse ioFog Operator versions 3.8.0 before 3.9.2, TLS certificate verification is disabled when the operator contacts the Controller AP CVE-2026-115228.8A vulnerability was detected in Tenda W20E 15.11.0.6. This vulnerability affects the function formSetPortMirror of the file /goform/setPortM CVE-2026-1152215.4A flaw was found in FreeIPA. An improper authorization check allows an authenticated host to retrieve and revoke digital certificates assign CVE-2026-1152234.9The Smart Popup by Supsystic WordPress plugin before 2.0.2 does not prevent template-injection payloads from being stored in a popup text bl CVE-2026-1152244.1The Customer Engagement System WordPress plugin before 2.0.2 does not safely build the SQL statements that store a popup's page and categor