PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-15275 wpexpertsio CVE debrief

The WP Multi Store Locator Pro plugin for WordPress is vulnerable to generic SQL Injection via the 'store_locatore_search_radius' parameter in all versions up to, and including, 4.5.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. The injection occurs in a numeric, unquoted SQL context, meaning WordPress's wp_magic_quotes() addslashes-based protection cannot neutralize the payload, and the AJAX handler is registered on wp_ajax

Vendor
wpexpertsio
Product
WP Multi Store Locator Pro
CVSS
HIGH 7.5
CISA KEV
Not listed in stored evidence
Original CVE published
2026-09-18
Original CVE updated
2026-09-18
Advisory published
2026-09-18
Advisory updated
2026-09-18

Who should care

Defenders responsible for WordPress installations with the WP Multi Store Locator Pro plugin should assess exposure and prioritize remediation. This vulnerability allows unauthenticated attackers to extract sensitive information from the database, which could lead to further exploitation or data breaches.

Why it matters

The WP Multi Store Locator Pro plugin vulnerability allows unauthenticated attackers to extract sensitive information from the database, posing a risk to WordPress installations. Defenders should prioritize verification and remediation to prevent potential data breaches and further exploitation.

  • Potential data breaches due to sensitive information extraction
  • Increased risk of further exploitation or unauthorized access

Technical summary

The WP Multi Store Locator Pro plugin for WordPress is vulnerable to generic SQL Injection via the 'store_locatore_search_radius' parameter in all versions up to, and including, 4.5.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.

Defensive priority

Defenders should prioritize verifying and remediating this vulnerability in their WordPress installations, especially those with untrusted user access.

Recommended defensive actions

  • Verify and remediate WP Multi Store Locator Pro plugin versions up to 4.5.1 in WordPress installations
  • Restrict user input to prevent SQL injection attacks
  • Monitor for suspicious database queries
  • Review compensating controls for exposed systems while remediation is scheduled and verified
  • Check relevant monitoring, detection, and logs for exposed assets that need extra review
  • Track exceptions, retest remediated assets, and close the item only after evidence is documented
  • Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The vulnerability is confirmed in WP Multi Store Locator Pro plugin versions up to 4.5.1. The CVE record and NVD entry provide details on the vulnerability, but additional information on exploitation or affected systems is limited.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-15275 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-15275

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-15275 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-15275

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.