CVE-2026-7249: Location Weather Plugin Auth Bypass Flaw

CVE-2026-7249 Overview

CVE-2026-7249 is a missing authorization vulnerability in the Location Weather plugin for WordPress, affecting all versions up to and including 3.0.2. The flaw resides in the splw_update_block_options() and lwp_clean_weather_transients() functions, which lack capability checks. Authenticated users with Contributor-level access or higher can disable all weather blocks and purge cached weather transients on affected sites. The required nonce is exposed to any authenticated user through wp_localize_script() registered on the init hook, removing a meaningful access barrier. The issue is tracked under [CWE-862] Missing Authorization.

Critical Impact
Contributor-level attackers can disable all weather blocks site-wide and purge all weather cache transients, degrading site functionality without administrator interaction.

Affected Products

WordPress Location Weather plugin versions up to and including 3.0.2
Sites using the plugin with Contributor-level or higher user registration enabled
Resolved in Location Weather plugin version 3.0.3

Discovery Timeline

2026-05-22 - CVE-2026-7249 published to NVD
2026-05-22 - Last updated in NVD database

Technical Details for CVE-2026-7249

Vulnerability Analysis

The vulnerability stems from two AJAX-style handlers in the Location Weather plugin that operate without verifying the caller's WordPress capabilities. The splw_update_block_options() function processes requests to modify block-level configuration, and lwp_clean_weather_transients() purges all cached weather data. Both functions check only the nonce, not the user role. WordPress nonces are intended as CSRF tokens, not authorization controls.

The required nonce is published to every authenticated session through wp_localize_script() on the init hook. Any logged-in user, including low-privilege Contributors, can read the nonce from the rendered page and replay it against the vulnerable endpoints. This converts a CSRF token into a freely available credential.

Root Cause

The root cause is the absence of a current_user_can() capability check inside the two handlers. WordPress security guidance requires both nonce verification and capability verification for state-changing actions. The Location Weather plugin enforces only the former. The fix in version 3.0.3 adds capability gating at lines 256 and 332 of Splw_Blocks_Page_Wrapper.php, restricting the actions to users with administrative privileges.

Attack Vector

Exploitation requires a valid authenticated session at the Contributor role or higher. The attacker loads any WordPress admin page that triggers the plugin's localized script, extracts the exposed nonce value, and issues a crafted request to the admin-ajax.php endpoint targeting the vulnerable actions. The response disables weather blocks across the site or flushes the transient cache, causing repeated outbound API calls to weather providers on subsequent page loads.

No code execution, data theft, or privilege escalation occurs. The impact is limited to integrity loss against plugin-managed content and configuration. See the Wordfence Vulnerability Analysis and the patched code in the WordPress Plugin Code Snippet for additional technical detail.

Detection Methods for CVE-2026-7249

Indicators of Compromise

Unexpected POST requests to admin-ajax.php with the splw_update_block_options or lwp_clean_weather_transients action parameter originating from Contributor-level accounts.
Sudden disabling of weather blocks across published pages without corresponding administrator activity in WordPress audit logs.
Unexplained spikes in outbound traffic to configured weather API providers caused by repeated cache rebuilds after transient purges.

Detection Strategies

Enable verbose logging on admin-ajax.php and correlate the action parameter with the authenticated user's role at request time.
Monitor changes to plugin option rows in the wp_options table tied to Location Weather block configuration.
Alert on any state-changing plugin action invoked by a user whose role is below Editor.

Monitoring Recommendations

Track the installed version of the Location Weather plugin across all WordPress instances and flag any host running 3.0.2 or earlier.
Review recent registrations of Contributor and Author accounts for anomalous creation patterns.
Baseline the volume of weather API requests so cache-purge abuse produces a detectable deviation.

How to Mitigate CVE-2026-7249

Immediate Actions Required

Update the Location Weather plugin to version 3.0.3 or later on every WordPress installation.
Audit all Contributor, Author, and Editor accounts and disable any that are unused or unrecognized.
Restrict open user registration on sites that do not require it to remove the precondition for exploitation.

Patch Information

The vendor addressed CVE-2026-7249 in Location Weather version 3.0.3. The patch introduces capability checks in splw_update_block_options() and lwp_clean_weather_transients() within includes/Admin/AdminDashboard/Splw_Blocks_Page_Wrapper.php. Refer to the patched source at line 256 and line 332 for verification.

Workarounds

Temporarily deactivate the Location Weather plugin until version 3.0.3 can be deployed.
Apply a Web Application Firewall rule blocking POST requests to admin-ajax.php with action=splw_update_block_options or action=lwp_clean_weather_transients when the session role is below edit_others_posts.
Limit low-privilege role assignments and require administrator approval for new account creation.

bash

# Configuration example: WP-CLI commands to inventory and update the plugin
wp plugin get location-weather --field=version
wp plugin update location-weather --version=3.0.3
wp plugin verify-checksums location-weather