WordPress WP Store Locator plugin versions older than 3.0.0 contain an unauthenticated flaw that permits attackers to trigger a denial of service by sending crafted requests that may exhaust server resources. The weakness is a resource‑exhaustion flaw listed as CWE‑770. With a CVSS score of 5.9 the vulnerability is considered moderate and can reduce site availability for all visitors when triggered successfully.

This vulnerability affects the WP Store Locator WordPress plugin, specifically all installations of versions less than 3.0.0. The plugin is developed by Tijmen Smit and is distributed through the WordPress plugin repository.

The CVSS score of 5.9 classifies the flaw as moderate. No EPSS score is available, so the likelihood of exploitation cannot be quantified from current data, and it is not listed in the CISA KEV catalog. The likely attack vector is a remote attacker repeatedly sending crafted HTTP requests to the plugin endpoint on a publicly accessible WordPress site; this inference is based on the description’s mention of an unauthenticated denial of service. No further information is given on prerequisites or the need for privileged access.