Severe Unpatched Vulnerabilities Leads to Closure of Store Locator Plus Plugin

On March 5, 2021, the Wordfence Threat Intelligence team wrapped up an investigation that led to the discovery of a privilege escalation vulnerability along with several additional vulnerabilities in Store Locator Plus, a WordPress plugin installed on over 9,000 sites.

We initially reached out to the plugin’s developer on March 5, 2021. We received no response for a week before we attempted to make contact again. After receiving no response for 20 days, and after two contact attempts, we escalated the issue to the WordPress Plugins team on March 25, 2021, providing the full details of the vulnerability at the time of reporting.

The WordPress Plugins team responded to us the same day informing us that they would notify the plugin’s developer of our findings. The developer released a patch on April 5, 2021, but the patch was insufficient, leading to the closure of the plugin on April 12, 2021.

Wordfence Premium users received firewall rules protecting against these vulnerabilities on March 5, 2021, while those still using the free version of Wordfence received the same protection on April 4, 2021. Regardless, we strongly recommend deactivating and removing this plugin immediately and finding a replacement. We do not know at this point if the plugin will be patched.

Store Locator Plus is a plugin designed to add a store locator to a WordPress site and makes it very simple to do so. Unfortunately, there was functionality in the plugin that made it possible for authenticated users to update their user meta data to become an administrator on any site using the plugin. This could allow attackers to gain administrative access to a site and completely take it over.

This vulnerability was partially patched in version 5.5.15. However, our analysis indicates that it is not sufficient and, therefore, should be treated as an unpatched vulnerability.

In addition to the privilege escalation vulnerability, we found several endpoints in the plugin that could allow unauthenticated attackers the ability to inject malicious JavaScript into pages. These could be used by an attacker to inject backdoors or add new administrative user accounts, ultimately leading to complete site compromise.

How can I protect my site?

We strongly recommend deactivating and removing the Store Locator Plus plugin and finding a replacement, as this plugin may not be patched in the foreseeable future. If you must keep the plugin installed on your site until you find a replacement, and you are running the Wordfence Web Application Firewall, then you can rest assured that your site will be protected against any exploits targeting this vulnerability while searching for a replacement store locator solution.

We are intentionally providing minimal details about these vulnerabilities to provide users ample time to find an alternative solution. We may provide additional details later as we continue to monitor the situation.