Locatoraid Store Locator WordPress plugin: Cross-Site Request Forgery

Summary

The Locatoraid Store Locator WordPress plugin up to and including version 3.9.75 contains a Cross-Site Request Forgery (CSRF) flaw. An unauthenticated attacker can craft a malicious link or page that, when opened by a logged-in administrator, performs actions in the plugin without the user's intent. Per the CVSS vector, the impact is limited to low integrity and availability effects, with no confidentiality impact.

Affected

• Locatoraid Store Locator WordPress plugin, versions 0 through 3.9.75 (CVE record: from n/a through 3.9.75)

Fixed in

• Version 3.9.76 (per CVE record and Patchstack; not yet confirmed on WordPress.org)

Workaround

• No vendor workaround known. Until the update is applied, keep administrator sessions short, log out of WordPress when not in use, and avoid browsing untrusted sites while logged in.

Exploitation

• Not known to be exploited. KEV: No.
• CISA SSVC: Exploitation none, automatable no, technical impact partial.
• No public proof-of-concept found in the sources checked.

Our recommendation

• Check whether the installed plugin version is 3.9.75 or older.
• Update to version 3.9.76 or later, after confirming the version is available from the vendor or WordPress.org.
• Review administrator accounts and limit admin sessions.
• Keep the plugin updated in general, as it has had other serious vulnerabilities.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• Patchstack advisory patchstack.com
• CVE Record CVE-2026-124263 www.cve.org
• WPScan plugin page Locatoraid wpscan.com
• OffSeq threat radar entry radar.offseq.com
• WordPress.org plugin page Locatoraid wordpress.org

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 11 Nov 2026, 17:12.