CVE-2026-115205 — Vulnerability intelligence

—

Published: 2026-11-03T06:17:37.767

CVSS

6.5

CISA KEV

Not listed; not proof of no exploitation

Original source text (not a translation)

The AZEXO Store Locator WordPress plugin through 1.4 does not have a capability check or any authorization control when deleting a post, allowing any authenticated user, such as a subscriber, to delete arbitrary posts and pages.

Sources

• CVE-2026-115205
• Original advisory