PT-2025-24253 · WordPress · Agile Logix Store Locator

Nguyen Kim Sang · Published 2025-06-06 · Updated 2025-06-06 · CVE-2025-49329

Positive Technologies (AI Summary)

CVSS v3.1

6.6

Medium

Base vector

AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:L

Name of the Vulnerable Software and Affected Versions Agile Logix Store Locator WordPress versions 1.5.2 and earlier

Description The issue allows for the unrestricted upload of files with dangerous types, enabling an attacker to upload a web shell to a web server.

Recommendations For Agile Logix Store Locator WordPress versions 1.5.2 and earlier, update to a version that fixes this issue. As a temporary workaround, consider restricting file uploads to prevent potential exploitation.

Fix

Unrestricted File Upload

Weakness Enumeration

CWE-434

Related Identifiers

CVE-2025-49329

Affected Products

Agile Logix Store Locator

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2025-49329 · Security Note
• https://patchstack.com/database/Wordpress/Plugin/agile-store-locator/vulnerability/wordpress-store-locator-wordpress-1-5-2-arbitrary-file-upload-vulnerability?_s_id=cve · Note
• https://twitter.com/CVEnew/status/1931037321807142947 · Twitter Post
• https://patchstack.com/database/wordpress/plugin/agile-store-locator/vulnerability/wordpress-store-locator-wordpress-1-5-2-arbitrary-file-upload-vulnerability?_s_id=cve · Note