Executive brief
WP Multi Store Locator Pro is a WordPress plugin used to display store locations on websites. The plugin contains a SQL injection vulnerability in its search functionality that allows attackers to directly query the site's database without needing a user account, potentially exposing customer data, business information, and other sensitive details stored in the database.
Technical details
The vulnerability is a generic SQL injection flaw in the 'store_locatore_search_radius' parameter processed by the AJAX handler registered as 'wp_ajax_nopriv_make_search_request'. The root cause is insufficient escaping of user-supplied input combined with lack of prepared SQL statements. The injection occurs in a numeric, unquoted SQL context, bypassing WordPress's standard addslashes-based protection. Since the AJAX handler is registered on wp_ajax_nopriv with no nonce or capability checks, the vulnerability is fully accessible to unauthenticated attackers over the network. An attacker can append arbitrary SQL queries to extract sensitive information from the database. The vulnerability affects all versions up to and including 4.5.1.
Affected products
- Codeastrology WP Multi Store Locator Pro up to and including 4.5.1
Timeline
- 2026-09-18: disclosed