WP Store Locator <= 3.1.0 - Authenticated (Store Locator Manager+) Sensitive Information Exposure via Bulk Geocode Tool
- ID
- WPSEC-2026-1772
- Plugin
- WP Store Locator (wp-store-locator)
- Affected
- from 3.0.0 before 3.1.1
- Remediation
- Update to 3.1.1 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N
- Weakness
- CWE-200
- Usage
- Plugin Medium · Affected versions Low among sites WPSec scans, 2026-10-27
- Attack surface
- WP Store Locator on WPSec AttackSurface
- Fix released
- Published
Description
The WP Store Locator plugin for WordPress is vulnerable to Sensitive Information Exposure via the bulk geocode tool ('wpsl_geocode_locations' AJAX action) in versions 3.0.0 up to, and including, 3.1.0. This is due to the tool looking up and returning the title of every post ID in the request before it checks that the ID belongs to a store the user can edit. This makes it possible for authenticated attackers with Store Locator Manager-level access and above to read the titles of any post on the site, of any post type. That includes content their role cannot otherwise see, such as the email addresses used as the titles of personal data export and erasure requests.
References
- https://wpsec.com/vuln/WPSEC-2026-1772/
- https://plugins.svn.wordpress.org/wp-store-locator/tags/3.1.1/
- https://wordpress.org/plugins/wp-store-locator/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS