CVE-2026-15275: WP Multi Store Locator Pro <= 4.5.1 - Unauthenticated SQL Injection via 'store_locator_search_radius' Parameter
The WP Multi Store Locator Pro plugin for WordPress is vulnerable to generic SQL Injection via the 'storelocatoresearchradius' parameter in all versions up to, and including, 4.5.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. The injection occurs in a numeric, unquoted SQL context, meaning WordPress's wpmagicquotes() addslashes-based protection cannot neutralize the payload, and the AJAX handler is registered on wpajaxnoprivmakesearchrequest with no nonce or capability check, making it fully accessible without authentication.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
WP Multi Store Locator Pro (WordPress plugin)to a version that resolves this vulnerability.Fixed in 4.5.1 - Configuration
Modify the AJAX handler registration so it is not exposed to unauthenticated users (do not register on wp_ajax_nopriv_make_search_request / require authentication and perform a capability check).
WP Multi Store Locator Pro (WordPress plugin) wp_ajax_nopriv_make_search_request access control = authenticated-only (remove nopriv) - Configuration
Require and verify a nonce for the AJAX endpoint that processes the store_locatore_search_radius parameter (prevent unauthenticated requests from reaching the vulnerable query path).
WP Multi Store Locator Pro (WordPress plugin) AJAX request validation = nonce required
Event History
Frequently Asked Questions
Who is exposed to exploitation?
Any site running WP Multi Store Locator Pro version 4.5.1 or earlier is exposed if the vulnerable AJAX handler is reachable. The handler is registered for unauthenticated requests, so an attacker does not need a WordPress account or any privileges.
What does an attacker need to exploit this issue?
An attacker only needs network access to submit a crafted value through the vulnerable search-radius parameter to the public AJAX handler. No authentication, nonce, capability, or user interaction is required.
What information could be exposed?
The SQL injection can be used to append SQL to an existing query and extract sensitive information from the WordPress database. The provided severity vector indicates high confidentiality impact, with no stated integrity or availability impact.
Are default WordPress protections sufficient to prevent exploitation?
No. The injection is in a numeric, unquoted SQL context, so WordPress wp_magic_quotes() addslashes-based protection does not neutralize the payload.