Home

Description

The Location Weather plugin for WordPress is vulnerable to unauthorized modification of data due to missing capability checks on the `splw_update_block_options()` and `lwp_clean_weather_transients()` functions in all versions up to, and including, 3.0.2. This makes it possible for authenticated attackers, with Contributor-level access and above, to disable all weather blocks and purge all weather cache transients. The nonce required for these actions is exposed to all authenticated users via `wp_localize_script()` on the `init` hook.

PUBLISHED Reserved 2026-04-27 | Published 2026-05-22 | Updated 2026-05-22 | Assigner Wordfence




MEDIUM: 4.3CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Problem types

CWE-862 Missing Authorization

Product status

Default status
unaffected

Any version
affected

Timeline

2026-04-28:Vendor Notified
2026-05-21:Disclosed

Credits

momopon1415 finder

References

www.wordfence.com/...-1623-4791-9d56-715d90fe0469?source=cve

plugins.trac.wordpress.org/...d/Splw_Blocks_Page_Wrapper.php

plugins.trac.wordpress.org/...d/Splw_Blocks_Page_Wrapper.php

wordpress.org/plugins/location-weather/

plugins.trac.wordpress.org/...d/Splw_Blocks_Page_Wrapper.php

plugins.trac.wordpress.org/...d/Splw_Blocks_Page_Wrapper.php

cve.org (CVE-2026-7249)

nvd.nist.gov (CVE-2026-7249)

Download JSON