Description
The AZEXO Store Locator WordPress plugin through 1.4 does not have a capability check or any authorization control when deleting a post, allowing any authenticated user, such as a subscriber, to delete arbitrary posts and pages.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| — | AZEXO Store Locator | ≤ 1.4 | — |
References
- https://wpscan.com/vulnerability/1b5ad120-2d39-49c9-89a1-f9385339cbcb/ exploit vdb-entry technical-description