An authenticated attacker with Editor-level or higher privileges can upload a ZIP file that bypasses file‑type checks in the DocoDoco Store Locator plugin. The uncontrolled file upload allows arbitrary files to be placed on the web server, creating the possibility of executing malicious code. This flaw represents a classic arbitrary‑file‑upload vulnerability and is classified as CWE‑434.

The vulnerability exists in the DocoDoco Store Locator plugin for WordPress, made by Geolocation Technology, in all releases up to and inclusive of version 1.0.1. Sites running this plugin with any authenticated user holding Editor or higher role are exposed.

The CVSS base score of 7.2 indicates a high impact once the flaw is exploited. The EPSS score is less than 1 %, suggesting that, although the weakness could lead to remote code execution, it is considered unlikely to be widely exploited at present. The plugin is not listed in CISA’s KEV catalog. Attackers must first authenticate as an Editor or higher user, then perform a ZIP upload to place malicious payloads in accessible web directories. If a PHP file or other executable is uploaded, the attacker could gain remote code execution, or at minimum compromise site integrity.