WP Store Locator CVE-2026-94681

Exploitable by a remote, unauthenticated attacker (PR:N, UI:N) against sites running WP Store Locator before version 3.0.0, but only by issuing requests that trigger the plugin's uncontrolled resource consumption. The primary limiting factor is High attack complexity (AC:H): the attacker must discover and craft the specific request pattern (likely a store-search/map data query) that causes disproportionate server-side work, and typically must repeat or scale it to actually exhaust resources. Impact is confined to availability (site slowdown or outage); there is no data disclosure or modification. Exploitation is limited to environments where the plugin's affected endpoint is publicly reachable.

This is a genuine but moderate-priority issue rather than a top-tier emergency. The CVSS 3.1 base score of 5.9 (Medium) is driven entirely by availability impact (A:H) with no confidentiality or integrity effect (C:N/I:N), reflecting CWE-770 (Allocation of Resources Without Limits or Throttling). The vector CVSS:3.1/AV:N/AC:H/PR:N/UI:N is a mixed signal: it is network-reachable and unauthenticated (PR:N, no UI), which favors the attacker, but High Attack Complexity (AC:H) means exploitation requires specific conditions or crafting (e.g., a particular request shape or repeated/expensive operations) rather than a trivial single request - this is the main brake on real-world risk. No EPSS score, no CISA KEV listing, and no public POC were provided in the intelligence, so there is no evidence of active exploitation or automated weaponization at this time. Net: a real, patchable availability weakness worth remediating on a normal cycle, not a drop-everything issue. Key data gap: the Patchstack description is sparse and names no specific endpoint, parameter, or resource-exhaustion mechanism - the exact trigger should be verified against the Patchstack advisory or the 3.0.0 changelog before writing detection or WAF rules.

A remote, unauthenticated attacker sends specially crafted requests to a public WP Store Locator endpoint (for example a store-search or map/data query) that triggers an unbounded or disproportionately expensive server-side operation. Repeating or scaling this request exhausts server resources (CPU, memory, or worker processes), degrading or taking the WordPress site offline. No public exploit code is identified at time of analysis, and the High attack complexity means the attacker must first identify the precise request pattern that triggers the excessive consumption.