CVE-2026-15275: WP Multi Store Locator Pro SQL Injection

CVE-2026-15275 Overview

CVE-2026-15275 is an unauthenticated SQL Injection vulnerability affecting the WP Multi Store Locator Pro plugin for WordPress. The flaw resides in the store_locatore_search_radius parameter processed by the plugin's AJAX search handler. All versions up to and including 4.5.1 are affected. Because the parameter is used in a numeric, unquoted SQL context, WordPress's built-in wp_magic_quotes() protection cannot neutralize injected payloads. The AJAX endpoint is registered on wp_ajax_nopriv_make_search_request without any nonce or capability check, allowing unauthenticated attackers to reach the vulnerable code path directly.

Critical Impact
Unauthenticated remote attackers can inject arbitrary SQL and extract sensitive data from the WordPress database, including user credentials, session tokens, and configuration secrets.

Affected Products

WP Multi Store Locator Pro plugin for WordPress
All versions up to and including 4.5.1
Distributed via CodeCanyon

Discovery Timeline

2026-09-18 - CVE-2026-15275 published to NVD
2026-09-19 - Last updated in NVD database

Technical Details for CVE-2026-15275

Vulnerability Analysis

The vulnerability is a classic SQL Injection flaw [CWE-89] triggered through the plugin's store search feature. The store_locatore_search_radius parameter is concatenated into a SQL query without proper parameterization. Because the value is embedded in a numeric context without surrounding quotes, WordPress's addslashes-based sanitization applied by wp_magic_quotes() provides no defense. Attackers append additional SQL statements or UNION-based payloads to the existing query. Successful exploitation returns database contents through the plugin's response, enabling full read access to any table accessible by the WordPress database user.

Root Cause

The root cause is insufficient escaping of user input combined with unsafe query construction. The plugin does not use wpdb::prepare() with proper placeholders such as %d for the numeric radius value. Compounding the issue, the AJAX action make_search_request is registered through wp_ajax_nopriv_*, which exposes the handler to unauthenticated visitors. No nonce validation or capability check gates the request.

Attack Vector

Exploitation occurs over the network via an HTTP POST request to wp-admin/admin-ajax.php with action=make_search_request and a malicious store_locatore_search_radius value. No authentication, user interaction, or elevated privileges are required. Attackers typically use time-based, boolean-based, or UNION-based injection techniques to enumerate schema and exfiltrate data. See the Wordfence Vulnerability Report for additional technical context.

Detection Methods for CVE-2026-15275

Indicators of Compromise

POST requests to /wp-admin/admin-ajax.php with action=make_search_request containing SQL keywords such as UNION, SELECT, SLEEP, or BENCHMARK in the store_locatore_search_radius parameter.
Unusually long response times from the AJAX endpoint indicating time-based blind injection.
Anomalous outbound queries against wp_users or wp_usermeta tables originating from the WordPress process.

Detection Strategies

Inspect web server access logs for requests to admin-ajax.php that include make_search_request from unauthenticated sessions.
Deploy WAF rules that flag non-numeric characters in the store_locatore_search_radius parameter.
Enable MySQL general query logging temporarily to identify malformed or injected queries referencing store locator tables.

Monitoring Recommendations

Alert on repeated 200-status responses to make_search_request from a single source IP within short time windows.
Monitor for spikes in database query duration correlated with plugin AJAX endpoints.
Track new administrator account creation and unexpected password hash reads following suspicious AJAX activity.

How to Mitigate CVE-2026-15275

Immediate Actions Required

Disable the WP Multi Store Locator Pro plugin until a patched version is installed.
Restrict access to admin-ajax.php from untrusted networks using a web application firewall.
Rotate WordPress secret keys in wp-config.php and reset administrator credentials if exploitation is suspected.
Audit the database for unauthorized users, modified options, or unexpected content changes.

Patch Information

No vendor patch is referenced in the NVD entry at the time of publication. Administrators should monitor the CodeCanyon WP Multi Store Locator Pro product page for updates beyond version 4.5.1 and apply the fixed release immediately upon availability.

Workarounds

Block requests to admin-ajax.php where the action parameter equals make_search_request using WAF or web server rules.
Deploy a virtual patch that enforces numeric-only validation on the store_locatore_search_radius parameter before it reaches PHP.
Restrict the WordPress database user's privileges to the minimum required, removing FILE and cross-database read permissions.

bash

# Example nginx rule to block exploitation attempts
location = /wp-admin/admin-ajax.php {
    if ($arg_action = "make_search_request") {
        return 403;
    }
}