CVE-2023-50885 MEDIUM

CVE-2023-50885: WordPress Store Locator WordPress Plugin <= 1.4.14 is vulnerable to Arbitrary File Deletion

Vendor Agilelogix
Product Store Locator WordPress
Weakness CWE-22 · Path traversal
Published April 18, 2024
Last update April 28, 2026
View on NVD All CVEs

CVSS base score

6.8/10
Attack vector Network
Attack complexity Low
Privileges required High
User interaction None
Confidentiality None
Integrity None

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:N/I:N/A:H

What the vulnerability does

01Description

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in AGILELOGIX Store Locator WordPress.This issue affects Store Locator WordPress: from n/a through 1.4.14.

Explanation of Vulnerability in Simple Terms

02Summary

The Store Locator plugin for WordPress versions up to 1.4.14 contains a path traversal vulnerability that allows high-privileged users to cause a denial of service by accessing files outside the intended directory. The vulnerability requires administrator-level access and does not affect data confidentiality or integrity. Sites running affected versions should update to a patched release.

What an attacker can do

03Attacker Capabilities

An administrator can trigger a denial of service by traversing the file system to access restricted files.

Potential impact on your site

04Site Impact

An administrator account could be used to crash or disable your site by accessing files outside the plugin directory.

Conditions required to exploit

05Prerequisites

Attacker must have administrator-level access to the WordPress site.

Key dates

06Disclosure timeline

April 18, 2024 CVE published
April 28, 2026 Record updated

Related vulnerabilities

08Related CVE

CVE-2016-20076 WordPress Simple-Backup 2.7.11 Arbitrary File Deletion and Download CVE-2026-57401 WordPress SureDash plugin <= 1.8.0 - Arbitrary File Deletion vulnerability CVE-2026-16078 WCPOS <= 1.9.8 - Authenticated (Shop Manager+) Path Traversal to Arbitrary File Read via 'type' Parameter CVE-2026-65765 Joomla Extension - phoca.cz - Path traversal vulnerability in Phoca Commander 1.0.0-6.1.1 CVE-2026-9145 Database for Contact Form 7, WPforms, Elementor forms <= 1.5.1 - Unauthenticated Arbitrary File Copy/Upload via Elementor Pro Form Upload Field 'raw_value'