CVE-2026-115205: Security vulnerability

Published Nov 3, 2026

Updated

The AZEXO Store Locator WordPress plugin through 1.4 does not have a capability check or any authorization control when deleting a post, allowing any authenticated user, such as a subscriber, to delete arbitrary posts and pages.

Event History

Nov 3, 2026

CVE Published

via NVD·06:17 AM

Data Sourced

via NVD·06:17 AM

Description

Frequently Asked Questions

Who can exploit this issue?

Any authenticated WordPress user can exploit it, including users with the low-privilege Subscriber role. The issue does not require post-deletion permissions.

What content can be deleted?

An attacker can delete arbitrary WordPress posts and pages through the affected plugin functionality.

Which plugin versions are affected?

AZEXO Store Locator versions through 1.4 are affected.

CVE-2026-115205: Security vulnerability

Event History

Frequently Asked Questions

Who can exploit this issue?

What content can be deleted?

Which plugin versions are affected?

Company

Resources

Contact

Frequently Asked Questions

Who can exploit this issue?

What content can be deleted?

Which plugin versions are affected?