The Agile Logix Store Locator WordPress plugin versions up to 1.5.2 contain an unrestricted file upload vulnerability that allows an attacker with high privileges to upload files of dangerous types, such as web shells, to the web server. This can result in partial compromise of confidentiality, integrity, and availability of the affected system. The vulnerability is network exploitable with low attack complexity and does not require user interaction. The CVSS vector indicates that the attacker must have privileges (PR:H) but no user interaction is needed, and the vulnerability affects confidentiality, integrity, and availability to a limited extent.

Successful exploitation could allow an attacker with high privileges to upload malicious files, such as web shells, to the server hosting the Store Locator plugin. This may lead to partial disclosure of information, modification of data, and disruption of service. The impact is rated medium with a CVSS score of 6.6, reflecting limited but significant risk.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict plugin usage to trusted administrators only and consider disabling file upload functionality if possible. Monitor for suspicious file uploads and remove the plugin if not required.