The Location Weather plugin for WordPress allows authenticated contributors and higher to change block settings and purge all weather cache transients without proper capability checks. The plugin exposes a nonce to all logged‑in users through wp_localize_script, enabling attackers to craft requests that bypass the usual permission requirements. This flaw can be exploited by any contributor or higher builder to disable weather interfaces on the site and clear all cached data, potentially disrupting user experience and rendering the plugin non‑functional.

WordPress sites that have the Location Weather plugin installed, version 3.0.2 or earlier, from the vendor shapedplugin: Location Weather – WordPress Weather Forecast, AQI, Temperature and Weather Widget.

The vulnerability has a CVSS score of 4.3, indicating low severity, and no EPSS data is available. It is not listed in the CISA KEV catalog. Attackers must first be authenticated with Contributor role or higher, then they can submit requests using the exposed nonce. The impact is limited to block configuration and cache but can effectively disable the plugin’s visual features. Even though the likelihood of exploitation is not quantified, the low CVSS suggests it is not a high‑priority target but should still be remediated to prevent site disruption.