CVE

CVE-2026-9062

3.4

CVSSlow

Exploitable remotely over the internet · requires high privileges · user interaction needed.

Description

The Store Locator WordPress plugin before 1.6.9 does not validate a parameter before using it in a file path, allowing high-privileged users such as administrators to read arbitrary `.php` files from the server, including configuration files that contain database credentials and authentication keys.

Attack Vector

Network

Privileges Req.

High

User Interaction

Required

store locator wordpress

Updated Nov 10, 2026View on NVD →

S4E scanner

lowProduct Based Web Vulnerabilities~10 seconds

WordPress Agile Store Locator < 1.6.9 - Arbitrary File Read

The Agile Store Locator WordPress plugin before 1.6.9 does not validate a parameter before using it in a file path, allowing high-privileged users such as administrators to read arbitrary .php files from the server. References: https://wpscan.com/vulnerability/14014b6b-ce49-4778-822c-026ecafa1772/ https://wordpress.org/plugins/agile-store-locator/ https://nvd.nist.gov/vuln/detail/CVE-2026-9062 Remediation: Update to version 1.6.9 or later.

Used 20 times · 10 assets checked · domain, subdomain, ipv4

Scanner page →Run scanner

CVE history: store locator wordpress

Predict next CVE date with AI

Monitor this CVE on your assets

S4E maps published CVEs to scanners and forecasts the next disclosure window for your stack.

Create a free account →