WordPress Store Locator Plugin SQL Injection Flaw

The WP Multi Store Locator Pro plugin for WordPress is vulnerable to generic SQL Injection via the 'store_locatore_search_radius' parameter in all versions up to, and including, 4.5.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. The injection occurs in a numeric, unquoted SQL context, meaning WordPress's wp_magic_quotes() addslashes-based protection cannot neutralize the payload, and the AJAX handler is registered on wp_ajax_nopriv_make_search_request with no nonce or capability check, making it fully accessible without authentication.

Casky was already ahead

This CVE exploits attack patterns that Casky's 323matched skills already investigate — long before this vulnerability was disclosed. Claude's reasoning model maps these techniques to MITRE ATT&CK, so practitioners who ran these skills have already seen the threat behaviour in their findings.

Analysis

The WP Multi Store Locator Pro plugin contains a critical SQL injection vulnerability in the 'store_locatore_search_radius' parameter that affects all versions through 4.5.1. This flaw stems from insufficient input escaping and improperly prepared SQL queries, allowing unauthenticated attackers to inject arbitrary SQL commands. With a CVSS score of 7.5, this vulnerability poses a high risk to any WordPress installation using this plugin, potentially exposing sensitive database information including user credentials, customer data, and business intelligence. The lack of authentication requirements makes this particularly dangerous, as any internet-facing WordPress site becomes a potential target for automated exploitation at scale.

Casky's 323 matching skills leverage Claude's extended reasoning to detect the attack patterns mapped to MITRE ATT&CK techniques TA0001 (Initial Access) and TA0043 (Reconnaissance). Practitioners using Casky would identify detection signals including unusual SQL syntax in HTTP parameters, multiple failed or successful database queries from single requests, and attempts to enumerate database structure through error-based injection techniques. The platform's skills would flag suspicious patterns in web application logs showing malformed SQL fragments in search parameters, time-delay injection attempts, and UNION-based query manipulation—all hallmarks of SQL injection exploitation. Security teams would receive findings highlighting the reconnaissance phase where attackers probe for database structure, followed by data exfiltration attempts, enabling them to correlate these attack chains with actual threat activity before compromise occurs.

Live Threat IntelligenceComing soon

Casky Risk Score

—

EPSS Probability

—

Shodan Exposure

—

GreyNoise Signal

—

Composite risk scoring from EPSS, CISA KEV, Shodan, and GreyNoise — 21 security APIs correlated into a single Casky Risk Score. Coming in Casky Pro. Join early access →

323 Casky skills cover this attack pattern

These skills use Claude AI's reasoning model to surface findings in the same attack categories as CVE-2026-15275.

Abuse of Public-Facing API: Mobile API Abuse

mobile security · low

Run

abusing-dpapi-for-credential-access

red teaming · high

Run

abusing-shadow-credentials-for-privesc

red teaming · high

Run

MITRE ATT&CK Techniques

TA0001 TA0043

Investigate the attack patterns behind CVE-2026-15275

Casky has 323 skills that investigate the attack patterns behind CVE-2026-15275. Run one and get CVSS-scored findings in 3 minutes.

Run the skill that detects this →

X Instagram LinkedIn