CVE-2026-9062 — Agile Store Locator < 1.6.9 - Admin+ Arbitrary File Read via Path Traversal
The Store Locator WordPress plugin before 1.6.9 does not validate a parameter before using it in a file path, allowing high-privileged users such as administrators to read arbit…
Published: 2026-06-13 · CVSS: 3.4 · CVSS 3.1
The Store Locator WordPress plugin before 1.6.9 does not validate a parameter before using it in a file path, allowing high-privileged users such as administrators to read arbitrary `.php` files from the server, including configuration files that contain database credentials and authentication keys.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7