CVE-2026-39546: WordPress MultiLoca plugin <= 4.2.15 - Privilege Escalation vulnerability

Synopsis

This is a privilege escalation vulnerability in the WordPress MultiLoca plugin, versions 4.2.15 and earlier, developed by Techspawn. It is reachable over the network and requires only a low-privilege account (subscriber-level) to exploit, with no victim interaction needed. A successful attacker gains elevated permissions within the WordPress installation, enabling access to protected content, limited data modification, and partial disruption of site functionality. HarborGuard tracks this advisory and will make a patched-image rebuild available the moment an upstream fix is published.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must reach the WordPress service over the network; no local or physical access is required.

• AuthenticationRequired

  A low-privilege account is sufficient; subscriber-level WordPress credentials are enough to trigger the escalation.

• Victim interactionNot required

  No user action or social-engineering step is needed; the attacker operates entirely on their own.

• Attack complexityDetail

  Attack complexity is low, meaning the exploit is reliable and does not depend on race conditions or specific environmental factors.

Blast Radius

• A successful attacker gains elevated WordPress privileges beyond their subscriber role, unlocking access to restricted administrative or editorial functions.
• Confidentiality impact is high: the attacker can read protected site content, configuration data, and potentially stored credentials or user records accessible to higher-privilege roles.
• Integrity impact is partial: the attacker can modify persisted WordPress data such as posts, settings, or user metadata within the bounds of the escalated role.
• Availability impact is partial: the attacker can disrupt normal site operation, for example by deactivating plugins or altering settings in ways that degrade functionality.