Junglewise Threat Intelligence

CVE-2026-7249: ShapedPlugin Location Weather missing capability check in WordPress plugin

CVE-2026-7249 · Severity: medium · CVSS 4.3 · Published 2026-05-22

Executive brief

The Location Weather plugin for WordPress, which allows site owners to display weather forecasts and widgets, contains a security flaw that allows unauthorized users to modify plugin settings. Specifically, users with low-level 'Contributor' access can disable weather blocks and clear cached weather data. This could lead to service disruptions where weather information becomes unavailable to site visitors, potentially impacting the user experience or business operations for sites that rely on weather updates.

Technical details

The Location Weather plugin for WordPress is vulnerable to unauthorized modification of data in versions up to 3.0.2. This is due to missing capability checks on the 'splw_update_block_options()' and 'lwp_clean_weather_transients()' functions. An authenticated attacker with Contributor-level permissions or higher can exploit this to disable weather blocks or purge weather cache transients. Furthermore, the security nonce required for these actions is improperly exposed to all authenticated users via the 'wp_localize_script()' function on the 'init' hook, facilitating the exploit. The issue is addressed in version 3.0.3.

Affected products

  • ShapedPlugin LLC Location Weather Up to, and including, 3.0.2

Timeline

  • 2026-05-22: disclosed: Initial disclosure by Wordfence
  • 2026-05-22: advisory: NVD publication date

References

Related threats