The plugin does not enforce capability or nonce checks and fails to sanitize a request header used to build a file path. This allows an authenticated subscriber to write a file with any name, location, and content, creating a direct path to remote code execution on the affected WordPress site.

AZEXO Store Locator WordPress plugin versions 1.4 and earlier are affected. No other vendors or products are listed for this vulnerability.

Any authenticated user who is a subscriber can trigger the flaw via the azt_items_import AJAX action. No additional conditions are mentioned, meaning the exploit is feasible as soon as a user has subscriber credentials. EPSS data is not available and the vulnerability is not in the KEV catalog, but the lack of capability checks indicates a high potential for exploitation if an attacker can obtain or trick a subscriber or if subscriber accounts are compromised. The CVSS score is not supplied, yet the ability to arbitrarily write code strongly signals a severe risk.