Stats Digest Feeds
← Back to all CVEs

CVE-2026-7249

MEDIUM NVD
CVSS Score 4.3
Severity MEDIUM
Published May 22, 2026
Vendor unknown

Description

The Location Weather plugin for WordPress is vulnerable to unauthorized modification of data due to missing capability checks on the `splw_update_block_options()` and `lwp_clean_weather_transients()` functions in all versions up to, and including, 3.0.2. This makes it possible for authenticated attackers, with Contributor-level access and above, to disable all weather blocks and purge all weather cache transients. The nonce required for these actions is exposed to all authenticated users via `wp_localize_script()` on the `init` hook.

References