What is the CVSS score of CVE-2026-7249?

CVE-2026-7249 has a CVSS 3.1 base score of 4.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N. EPSS exploitation probability: 0.0%.

Location Weather CVE-2026-7249

EUVD-2026-31404 MEDIUM

Missing Authorization (CWE-862)

2026-05-22 Wordfence

GHSA-hx3j-p7vv-7jq2

WordPress Authentication Bypass

4.3

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

4.3 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

May 22, 2026 - 05:18 vuln.today

DescriptionCVE.org

The Location Weather plugin for WordPress is vulnerable to unauthorized modification of data due to missing capability checks on the splw_update_block_options() and lwp_clean_weather_transients() functions in all versions up to, and including, 3.0.2. This makes it possible for authenticated attackers, with Contributor-level access and above, to disable all weather blocks and purge all weather cache transients. The nonce required for these actions is exposed to all authenticated users via wp_localize_script() on the init hook.

AnalysisAI

Unauthorized modification of weather display settings in the Location Weather WordPress plugin (versions ≤3.0.2) is achievable by any authenticated user with Contributor-level access or above, due to missing capability checks on the administrative functions splw_update_block_options() and lwp_clean_weather_transients(). Affected sites expose the protective nonce to all authenticated sessions via wp_localize_script() on the init hook, neutralizing what would otherwise be a secondary CSRF defense and making exploitation straightforward for any logged-in user. No public exploit has been identified and the vulnerability is not listed in the CISA KEV catalog; real-world impact is limited to disruption of weather widget display and cache integrity rather than data theft or code execution.

Technical ContextAI

The Location Weather plugin (CPE: cpe:2.3:a:shapedplugin:location_weather_-_wordpress_weather_forecast,_aqi,_temperature_and_weather_widget:*:*:*:*:*:*:*:*) is a ShapedPlugin product providing weather forecast, AQI, and temperature widgets for WordPress sites. The root cause is CWE-862 (Missing Authorization): the functions splw_update_block_options() and lwp_clean_weather_transients(), located in includes/Admin/AdminDashboard/Splw_Blocks_Page_Wrapper.php, execute privileged administrative operations without verifying whether the calling user holds the appropriate WordPress capability. In WordPress's permission model, capability checks (e.g., current_user_can('manage_options')) are the correct authorization gate for admin-level AJAX actions; their absence means the role-based access system is entirely bypassed. Compounding the flaw, WordPress nonces - normally used to prevent cross-site request forgery - are broadcast to every authenticated page load via wp_localize_script() called on the global init hook, making the nonce available to Contributors and above and rendering it ineffective as a compensating control.

RemediationAI

Vendor-released patch: 3.0.3. Update the Location Weather plugin to version 3.0.3 or later immediately via the WordPress admin dashboard under Plugins > Updates, or directly from the official plugin page at https://wordpress.org/plugins/location-weather/. The patched source in the 3.0.3 trac tag (https://plugins.trac.wordpress.org/browser/location-weather/tags/3.0.3/includes/Admin/AdminDashboard/Splw_Blocks_Page_Wrapper.php#L256 and #L332) introduces the missing capability checks to the affected functions. If an immediate update is not possible, restrict Contributor-level (and above) account registration on the affected WordPress site to limit the pool of potential attackers - note this does not eliminate the vulnerability for already-registered users. Alternatively, deactivating the plugin entirely will prevent exploitation but will remove all weather widgets from the front end, which may be unacceptable in production. There are no known workarounds that address the root cause without patching.