WordPress Plugin Ajax Store Locator is prone to a directory traversal vulnerability because it fails to sufficiently sanitize user-supplied input. Exploiting this issue can allow an attacker to obtain sensitive information that could aid in further attacks. WordPress Plugin Ajax Store Locator version 1.2.0 is vulnerable; prior versions may also be affected.

Edit the source code to ensure that input is properly verified or disable the plugin until a fix is available

• http://www.homelab.it/index.php/2014/12/06/wordpress-ajax-store-locator-arbitrary-file-download-vulnerability/
• http://www.exploit-db.com/exploits/35493/
• http://packetstormsecurity.com/files/129408/WordPress-Ajax-Store-Locator-1.2-Arbitrary-File-Download.html