EIP-2026-113796

PRE-CVE

WordPress Plugin Google Maps via Store Locator 2.7.1 < 3.0.1 - Multiple Vulnerabilities

Title source: legacy

Exploitation Summary

EIP tracks 1 public exploit for EIP-2026-113796. PoCs published by Sammy FORGIT.

AI-analyzed exploit summary The exploit demonstrates multiple vulnerabilities in the WordPress Store Locator Plus plugin, including information disclosure, arbitrary email sending, and blind SQL injection via crafted POST requests. The provided PHP script includes functional code to exploit these issues.

Description

WordPress Plugin Google Maps via Store Locator 2.7.1 < 3.0.1 - Multiple Vulnerabilities

Exploits (1)

exploitdb WORKING POC VERIFIED

by Sammy FORGIT · phpwebappsphp

https://www.exploit-db.com/exploits/18989

View Code ZIP pw:eip

The exploit demonstrates multiple vulnerabilities in the WordPress Store Locator Plus plugin, including information disclosure, arbitrary email sending, and blind SQL injection via crafted POST requests. The provided PHP script includes functional code to exploit these issues.

Classification

Working Poc 90%

Attack Type

Info Leak | Sqli

Complexity

Trivial

Reliability

Reliable

Target: WordPress Store Locator Plus plugin versions 2.7.1 to 3.0.1

No auth needed

Prerequisites: Access to the target WordPress site with the vulnerable plugin installed

MITRE ATT&CK

T1592 - Gather Victim Host Information T1189 - Drive-by Compromise T1190 - Exploit Public-Facing Application

devstral-2 · analyzed Feb 18, 2026 Full analysis →

Details

Status pre_cve

Tracked Since Feb 18, 2026