{"id":"CVE-2026-9062","aliases":["EUVD-2026-36644","GHSA-553w-8mm7-5gf2"],"status":"published","title":"Agile Store Locator \u003c 1.6.9 - Admin+ Arbitrary File Read via Path Traversal","description":"The Store Locator WordPress plugin before 1.6.9 does not validate a parameter before using it in a file path, allowing high-privileged users such as administrators to read arbitrary `.php` files from the server, including configuration files that contain database credentials and authentication keys.","severity":{"version":"3.1","score":3.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:N/A:N","level":"low","assessor":"adp","from":"cve"},"epss":{"day":"2026-11-09","score":0.00486,"percentile":0.42158,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-22"],"published":"2026-06-13T06:00:01Z","modified":"2026-07-21T19:10:00Z","exploits":[{"source":"nuclei","id":"CVE-2026-9062","title":"WordPress Agile Store Locator \u003c 1.6.9 - Arbitrary File Read","type":"detection template","url":"https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-9062.yaml"}],"products":[{"vendor":"agile logix","product":"store locator wordpress"},{"vendor":"unknown","product":"store locator wordpress"}],"references":[{"url":"https://wpscan.com/vulnerability/14014b6b-ce49-4778-822c-026ecafa1772/","tags":["exploit","vdb-entry","technical-description"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-9062"},{"url":"https://wpscan.com/vulnerability/14014b6b-ce49-4778-822c-026ecafa1772"},{"url":"https://github.com/advisories/GHSA-553w-8mm7-5gf2"}],"sources":{"cve":[{"id":"CVE-2026-9062","title":"Agile Store Locator \u003c 1.6.9 - Admin+ Arbitrary File Read via Path Traversal","description":"The Store Locator WordPress plugin before 1.6.9 does not validate a parameter before using it in a file path, allowing high-privileged users such as administrators to read arbitrary `.php` files from the server, including configuration files that contain database credentials and authentication keys.","status":"published","published":"2026-06-13T06:00:01.911Z","modified":"2026-06-15T14:48:05.704Z","cvss":[{"version":"3.1","score":3.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:N/A:N","level":"low","assessor":"adp"}],"cwes":["CWE-22"],"updated_at":"2026-11-02T13:42:37.965383Z"}],"euvd":[{"id":"EUVD-2026-36644","description":"The Store Locator WordPress plugin before 1.6.9 does not validate a parameter before using it in a file path, allowing high-privileged users such as administrators to read arbitrary `.php` files from the server, including configuration files that contain database credentials and authentication keys.","status":"published","published":"2026-06-13T06:00:01Z","modified":"2026-06-15T14:48:05Z","cvss":[{"version":"3.1","score":3.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:N/A:N","level":"low"}],"updated_at":"2026-11-02T18:20:41.888684Z"}],"ghsa":[{"id":"GHSA-553w-8mm7-5gf2","title":"The Store Locator WordPress plugin before 1.6.9 does not validate a parameter before using it in...","description":"The Store Locator WordPress plugin before 1.6.9 does not validate a parameter before using it in a file path, allowing high-privileged users such as administrators to read arbitrary `.php` files from the server, including configuration files that contain database credentials and authentication keys.","status":"published","published":"2026-06-13T09:31:27Z","modified":"2026-06-15T18:31:18Z","cvss":[{"version":"3.1","score":3.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:N/A:N","level":"low"}],"cwes":["CWE-22"],"updated_at":"2026-11-02T15:08:46.336077Z"}],"nvd":[{"id":"CVE-2026-9062","description":"The Store Locator WordPress plugin before 1.6.9 does not validate a parameter before using it in a file path, allowing high-privileged users such as administrators to read arbitrary `.php` files from the server, including configuration files that contain database credentials and authentication keys.","status":"published","published":"2026-06-13T07:16:14.757Z","modified":"2026-07-21T19:10:00.107Z","cvss":[{"version":"3.1","score":3.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:N/A:N","level":"low","assessor":"secondary"}],"cwes":["CWE-22"],"updated_at":"2026-11-02T14:12:23.846948Z"}]}}