CVE-2026-124263: WordPress Locatoraid Store Locator plugin <= 3.9.75 - Cross Site Request Forgery (CSRF) vulnerability

Q: What does an attacker need to exploit this issue?

An attacker needs to cause a user to interact with a crafted request, as indicated by the required user interaction vector. No attacker privileges are required.

Q: What is the potential impact if exploitation succeeds?

The available scoring indicates low impact to integrity and availability, with no confidentiality impact. The specific actions that can be performed through the forged request are not provided.

Q: Which plugin versions are affected?

Locatoraid Store Locator versions through 3.9.75 are affected. The earliest affected version is not specified.

Published Nov 11, 2026

Updated

Cross-Site Request Forgery (CSRF) vulnerability in plainware Locatoraid Store Locator locatoraid allows Cross Site Request Forgery.This issue affects Locatoraid Store Locator: from n/a through 3.9.75.

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade WordPress Locatoraid Store Locator to a version that resolves this vulnerability.
Fixed in 3.9.76

Event History

Nov 11, 2026

CVE Published

via MITRE·12:38 PM

Data Sourced

via MITRE·12:38 PM

RemedyDescriptionSeverityWeakness

Data Sourced

via NVD·01:17 PM

DescriptionSeverityWeakness

Frequently Asked Questions

What does an attacker need to exploit this issue?

An attacker needs to cause a user to interact with a crafted request, as indicated by the required user interaction vector. No attacker privileges are required.

What is the potential impact if exploitation succeeds?

The available scoring indicates low impact to integrity and availability, with no confidentiality impact. The specific actions that can be performed through the forged request are not provided.

Which plugin versions are affected?