CVE-2026-115204
AZEXO Store Locator <= 1.4 - Subscriber+ Arbitrary File Write via azt_items_import
CVSS Score
8.8
EPSS Score
0.0%
EPSS Percentile
0th
The AZEXO Store Locator WordPress plugin through 1.4 does not perform capability or nonce checks on its AJAX actions and does not sanitise a request header used to build a file path, allowing any authenticated user such as a subscriber to write a file with an arbitrary name, location, and content, leading to remote code execution.
| Vendor | unknown |
| Product | azexo store locator |
| Published | Nov 9, 2026 |
| Last Updated | Nov 9, 2026 |
Stay Ahead of the Next One
Get instant alerts for unknown azexo store locator
Be the first to know when new high vulnerabilities affecting unknown azexo store locator are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
Affected Versions
Unknown / AZEXO Store Locator
0 ≤ 1.4
References
Credits
WPScan