CVE-2026-15275 describes a SQL Injection vulnerability in the WP Multi Store Locator Pro WordPress plugin (versions up to and including 4.5.1). The flaw is due to improper neutralization of special elements in the 'store_locatore_search_radius' parameter, which is used in an unquoted numeric SQL context without sufficient escaping or prepared statements. The AJAX handler 'wp_ajax_nopriv_make_search_request' is exposed without authentication or nonce checks, enabling unauthenticated attackers to inject additional SQL commands and potentially extract sensitive data from the database. WordPress's wp_magic_quotes() addslashes-based protection does not mitigate this issue due to the numeric context of the injection.

An unauthenticated attacker can exploit this vulnerability to perform SQL Injection attacks, allowing them to extract sensitive information from the database. The vulnerability does not impact integrity or availability but has a high confidentiality impact. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict access to the vulnerable AJAX endpoint if possible or implement custom filtering and validation on the 'store_locatore_search_radius' parameter to prevent injection. Monitor vendor channels for official patches or updates.