CVE-2026-115205 in Store Locator Plugin
Summary
by MITRE • 11/03/2026
The AZEXO Store Locator WordPress plugin through 1.4 does not have a capability check or any authorization control when deleting a post, allowing any authenticated user, such as a subscriber, to delete arbitrary posts and pages.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 11/03/2026
The vulnerability identified in the AZEXO Store Locator WordPress plugin versions prior to 1.4 represents a critical failure in access control mechanisms within the application's backend logic. Specifically, the function responsible for handling post deletion requests lacks any form of capability verification or authorization check. In the context of Content Management Systems like WordPress, administrative actions such as deleting content are typically restricted to users with elevated privileges, such as administrators or editors. However, this implementation flaw allows any authenticated user, regardless of their assigned role, including those with the lowest privilege level such as subscribers, to execute deletion operations on arbitrary posts and pages within the system.
From a technical perspective, this issue stems from an absence of proper input validation regarding user permissions before processing state-changing requests. When a request is made to delete a post, the application fails to verify whether the requesting user possesses the necessary capabilities defined by the platform's security model. This oversight effectively bypasses the intended role-based access control framework, treating all authenticated sessions as equally privileged for this specific operation. The flaw allows an attacker who has obtained valid credentials for even a low-level account to manipulate the content structure of the website without restriction.
The operational impact of this vulnerability is significant and multifaceted. Primarily, it leads to unauthorized data destruction, where critical business information, customer contact details stored in posts or pages, and other essential content can be permanently removed by malicious insiders or compromised low-privilege accounts. This results in a severe compromise of data integrity and availability. Furthermore, the ability to delete arbitrary content can disrupt website functionality if those deleted items are referenced elsewhere on the site, potentially leading to broken links or missing store locator information for legitimate users. In scenarios where multiple contributors manage content, this vulnerability undermines trust among team members and complicates audit trails since deletions may appear as though they were performed by authorized personnel.
This type of flaw is formally categorized under CWE-269, which describes Improper Privilege Control, indicating that the software does not properly restrict permissions for privileged functions. Additionally, from a tactical standpoint aligned with the MITRE ATT&CK framework, this vulnerability facilitates lateral movement and impact through techniques associated with Account Manipulation or Data Destruction, specifically allowing an attacker to escalate their effective privileges by exploiting weak access controls rather than finding complex code execution flaws. It highlights the importance of enforcing strict authorization checks on all administrative endpoints within web applications.
To mitigate this risk, immediate action is required to update the AZEXO Store Locator plugin to version 1.4 or later, where these security gaps have been addressed. For organizations unable to upgrade immediately due to compatibility constraints, temporary mitigations should include restricting access to the WordPress admin area by IP address if possible, ensuring that all user accounts are monitored for suspicious activity, and implementing a Web Application Firewall capable of detecting anomalous deletion patterns. Long-term remediation strategies must involve integrating automated security testing into the development lifecycle to ensure that all state-changing operations enforce rigorous capability checks consistent with industry standards such as OWASP guidelines for access control.