CVE-2026-115205

MediumCVSS 6.5/10Last modified Nov 4, 2026

Description

The AZEXO Store Locator WordPress plugin through 1.4 does not have a capability check or any authorization control when deleting a post, allowing any authenticated user, such as a subscriber, to delete arbitrary posts and pages.

Metrics

CVSS 3.1 6.5/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

Weakness enumeration

CWE-862

Affected software

Vendor	Product	Versions
Unknown	AZEXO Store Locator	<= 1.4

References

https://wpscan.com/vulnerability/1b5ad120-2d39-49c9-89a1-f9385339cbcb/

Timeline

Published: Nov 3, 2026
Last modified: Nov 4, 2026
NVD status: Deferred

Related CVEs from 2026

CVE-2026-1152075.5A flaw was found in GNU patch. An attacker can achieve arbitrary file creation outside the intended working directory by enticing a user or CVE-2026-115216.3A security vulnerability has been detected in Mohammed-eid35 bank-management-system-springboot up to 7b9bcc65ad7df3db29af71aed9bb500e5f24d94 CVE-2026-1152128.8The mView 豆瓣电影 WordPress plugin through 1.0.3 does not validate the type, name, or source of a remotely fetched file, nor perform any capabi CVE-2026-1152139.8The EASY-JS-WPAPI Client HANDLE for the WordPress REST-API WordPress plugin through 2.0 does not prevent the administrator credentials it st CVE-2026-1152149.8The Datawiza Proxy Auth Plugin WordPress plugin before 1.1.1 does not verify that the user-identity and role HTTP request headers it trusts CVE-2026-1152158.7In Eclipse ThreadX NetX Duo versions 6.0 through 6.5.2.202603a, the NetX Secure DTLS server allocates a session from its fixed session pool CVE-2026-1152169.1In Eclipse ioFog Operator versions 3.8.0 before 3.9.2, TLS certificate verification is disabled when the operator contacts the Controller AP CVE-2026-115228.8A vulnerability was detected in Tenda W20E 15.11.0.6. This vulnerability affects the function formSetPortMirror of the file /goform/setPortM CVE-2026-1152215.4A flaw was found in FreeIPA. An improper authorization check allows an authenticated host to retrieve and revoke digital certificates assign CVE-2026-1152234.9The Smart Popup by Supsystic WordPress plugin before 2.0.2 does not prevent template-injection payloads from being stored in a popup text bl CVE-2026-1152244.1The Customer Engagement System WordPress plugin before 2.0.2 does not safely build the SQL statements that store a popup's page and categor CVE-2026-1152255.8The Customer Engagement System WordPress plugin before 2.0.2 does not restrict access to its MailChimp interest-group lookup or validate th