# WP Store Locator <= 3.1.0 - Authenticated (Store Locator Manager+) Sensitive Information Exposure via Bulk Geocode Tool

- **ID:** WPSEC-2026-1772
- **Plugin:** WP Store Locator (`wp-store-locator`), https://wordpress.org/plugins/wp-store-locator/
- **Affected versions:** from 3.0.0 before 3.1.1
- **Fixed in:** 3.1.1 (Update to 3.1.1 or later.)
- **Severity:** Low 2.7 (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N)
- **Weakness:** CWE-200
- **Usage among sites WPSec scans:** plugin Medium, affected versions Low (as of 2026-10-27)
- **Attack surface analysis:** https://attacksurface.wpsec.com/plugin/wp-store-locator
- **Fix released:** 2026-10-26
- **Published:** 2026-10-27
- **URL:** https://wpsec.com/vuln/WPSEC-2026-1772/

## Description

The WP Store Locator plugin for WordPress is vulnerable to Sensitive Information Exposure via the bulk geocode tool ('wpsl_geocode_locations' AJAX action) in versions 3.0.0 up to, and including, 3.1.0. This is due to the tool looking up and returning the title of every post ID in the request before it checks that the ID belongs to a store the user can edit. This makes it possible for authenticated attackers with Store Locator Manager-level access and above to read the titles of any post on the site, of any post type. That includes content their role cannot otherwise see, such as the email addresses used as the titles of personal data export and erasure requests.

## References

- https://wpsec.com/vuln/WPSEC-2026-1772/
- https://plugins.svn.wordpress.org/wp-store-locator/tags/3.1.1/
- https://wordpress.org/plugins/wp-store-locator/

Source: WPSec, https://wpsec.com/vuln/WPSEC-2026-1772/

License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Free to use, share and adapt, also commercially, if you credit WPSec and link to this advisory.