CVE-2026-7249
The Location Weather plugin for WordPress is vulnerable to unauthorized modification of data due to missing capability checks on the and functions in all versions up t…
Published May 22, 2026 · updated Jul 24, 2026
The Location Weather plugin for WordPress is vulnerable to unauthorized modification of data due to missing capability checks on the and functions in all versions up to, and including, 3.0.2. This makes it possible for authenticated attackers, with Contributor-level access and above, to disable all weather blocks and purge all weather cache transients. The nonce required for these actions is exposed to all authenticated users via on the hook.
Code
The project this record applies to. Exploit listings stay in References.
Timeline
Detection, updates, and resolution for this record.
May 22, 2026 · NIST NVD
Detected
The Location Weather plugin for WordPress is vulnerable to unauthorized modification of data due to missing capability checks on the and functions in all versions up to, and including, 3.0.2. This makes it possible for authenticated attackers, with Contributor-level access and above, to disable all weather blocks and purge all weather cache transients. The nonce required for these actions is expos
Jul 24, 2026 · NIST NVD
Updated
The Location Weather plugin for WordPress is vulnerable to unauthorized modification of data due to missing capability checks on the and functions in all versions up to, and including, 3.0.2. This makes it possible for authenticated attackers, with Contributor-level access and above, to disable all weather blocks and purge all weather cache transients. The nonce required for these actions is expos
Sources
- CVE.orgVulnerability recordCVE-2026-7249
Official CVE identifier
cve.org - NIST NVDVulnerability recordCVE-2026-7249
The Location Weather plugin for WordPress is vulnerable to unauthorized modification of data due to missing capability checks on the and functions in all versions up to, and including, 3.0.2. This makes it possible fo
nvd.nist.gov