{
 "id": "WPSEC-2026-1772",
 "url": "https://wpsec.com/vuln/WPSEC-2026-1772/",
 "json_url": "https://wpsec.com/vuln/WPSEC-2026-1772/advisory.json",
 "markdown_url": "https://wpsec.com/vuln/WPSEC-2026-1772/index.md",
 "title": "WP Store Locator <= 3.1.0 - Authenticated (Store Locator Manager+) Sensitive Information Exposure via Bulk Geocode Tool",
 "description": "The WP Store Locator plugin for WordPress is vulnerable to Sensitive Information Exposure via the bulk geocode tool ('wpsl_geocode_locations' AJAX action) in versions 3.0.0 up to, and including, 3.1.0. This is due to the tool looking up and returning the title of every post ID in the request before it checks that the ID belongs to a store the user can edit. This makes it possible for authenticated attackers with Store Locator Manager-level access and above to read the titles of any post on the site, of any post type. That includes content their role cannot otherwise see, such as the email addresses used as the titles of personal data export and erasure requests.",
 "plugin": {
  "slug": "wp-store-locator",
  "name": "WP Store Locator",
  "full_name": "WP Store Locator",
  "wordpress_org": "https://wordpress.org/plugins/wp-store-locator/",
  "advisories_url": "https://wpsec.com/vuln/plugin/wp-store-locator/",
  "attacksurface": "https://attacksurface.wpsec.com/plugin/wp-store-locator"
 },
 "type": "SENSITIVE DATA DISCLOSURE",
 "cwe": [
  "CWE-200"
 ],
 "cve": [],
 "cvss": {
  "version": "3.1",
  "score": 2.7,
  "vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N",
  "severity": "Low"
 },
 "affected": {
  "ranges": [
   {
    "from": "3.0.0",
    "from_inclusive": true,
    "to": "3.1.1",
    "to_inclusive": false
   }
  ],
  "text": [
   "from 3.0.0 before 3.1.1"
  ]
 },
 "introduced_in": "3.0.0",
 "fixed_in": "3.1.1",
 "remediation": "Update to 3.1.1 or later.",
 "fix_released": "2026-10-26T16:44:08+00:00",
 "published": "2026-10-27T16:48:00+00:00",
 "updated": "2026-10-27T13:04:42.108297+00:00",
 "also_published_as": null,
 "references": [
  "https://wpsec.com/vuln/WPSEC-2026-1772/",
  "https://plugins.svn.wordpress.org/wp-store-locator/tags/3.1.1/",
  "https://wordpress.org/plugins/wp-store-locator/"
 ],
 "attacksurface_url": "https://attacksurface.wpsec.com/plugin/wp-store-locator",
 "source": "WPSec",
 "license": {
  "name": "CC BY 4.0",
  "url": "https://creativecommons.org/licenses/by/4.0/"
 },
 "usage": {
  "plugin": "Medium",
  "affected_versions": "Low",
  "as_of": "2026-10-27"
 }
}