PT-2026-42727 · WordPress · Location Weather

Momopon1415 · Published 2026-05-22 · Updated 2026-05-22 · CVE-2026-7249

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions Location Weather versions prior to 3.0.3

Description The Location Weather plugin for WordPress allows unauthorized modification of data because the splw update block options() and lwp clean weather transients() functions lack capability checks. Authenticated attackers with Contributor-level access or higher can exploit this to disable all weather blocks and purge all weather cache transients. The required nonce is exposed to all authenticated users through wp localize script() on the init hook.

Recommendations Update to a version later than 3.0.2. As a temporary workaround, restrict access to the splw update block options() and lwp clean weather transients() functions to minimize the risk of exploitation.

Fix

Missing Authorization

Weakness Enumeration

CWE-862

Related Identifiers

CVE-2026-7249

Affected Products

Location Weather

References · 8

• https://nvd.nist.gov/vuln/detail/CVE-2026-7249 · Security Note
• https://wordfence.com/threat-intel/vulnerabilities/id/d472011d-1623-4791-9d56-715d90fe0469?source=cve · Note
• https://plugins.trac.wordpress.org/browser/location-weather/tags/3.0.2/includes/Admin/AdminDashboard/Splw_Blocks_Page_Wrapper.php#L331 · Note
• https://twitter.com/CVEnew/status/2057783178148868408 · Twitter Post
• https://plugins.trac.wordpress.org/browser/location-weather/tags/3.0.2/includes/Admin/AdminDashboard/Splw_Blocks_Page_Wrapper.php#L256 · Note
• https://wordpress.org/plugins/location-weather · Note
• https://plugins.trac.wordpress.org/browser/location-weather/tags/3.0.3/includes/Admin/AdminDashboard/Splw_Blocks_Page_Wrapper.php#L256 · Note
• https://plugins.trac.wordpress.org/browser/location-weather/tags/3.0.3/includes/Admin/AdminDashboard/Splw_Blocks_Page_Wrapper.php#L332 · Note