CVE-2026-115204: AZEXO Store Locator <= 1.4 - Subscriber+ Arbitrary File Write via azt_items_import

Q: Who can exploit this issue?

Any authenticated WordPress user, including a user with only the Subscriber role, can exploit it. The affected AJAX actions lack capability and nonce checks.

Q: What does an attacker need to achieve remote code execution?

The attacker needs a valid authenticated WordPress account. They can use the azt_items_import AJAX action to write attacker-controlled file names, locations, and contents, which can lead to remote code execution.

Q: How can I determine whether my site is affected?

Sites using AZEXO Store Locator version 1.4 or earlier are affected. Review the plugin's installed version and investigate for unexpected files in locations writable by the web server, particularly files with unusual names or contents.

Published Nov 9, 2026

Updated

The AZEXO Store Locator WordPress plugin through 1.4 does not perform capability or nonce checks on its AJAX actions and does not sanitise a request header used to build a file path, allowing any authenticated user such as a subscriber to write a file with an arbitrary name, location, and content, leading to remote code execution.

Affected Software

1 affected component

AZEXO Store Locator<=1.4

Event History

Nov 9, 2026

CVE Published

via MITRE·06:00 AM

Data Sourced

via MITRE·06:00 AM

DescriptionWeakness

Data Sourced

via NVD·07:17 AM

Description

Frequently Asked Questions

Who can exploit this issue?

Any authenticated WordPress user, including a user with only the Subscriber role, can exploit it. The affected AJAX actions lack capability and nonce checks.

What does an attacker need to achieve remote code execution?

The attacker needs a valid authenticated WordPress account. They can use the azt_items_import AJAX action to write attacker-controlled file names, locations, and contents, which can lead to remote code execution.

How can I determine whether my site is affected?

Sites using AZEXO Store Locator version 1.4 or earlier are affected. Review the plugin's installed version and investigate for unexpected files in locations writable by the web server, particularly files with unusual names or contents.

CVE-2026-115204: AZEXO Store Locator <= 1.4 - Subscriber+ Arbitrary File Write via azt_items_import

Affected Software

Event History

Frequently Asked Questions

Who can exploit this issue?

What does an attacker need to achieve remote code execution?

How can I determine whether my site is affected?

Company

Resources

Contact

Frequently Asked Questions

Who can exploit this issue?

What does an attacker need to achieve remote code execution?

How can I determine whether my site is affected?