CVE-2026-9062

LowPublished

Agile Store Locator < 1.6.9 - Admin+ Arbitrary File Read via Path Traversal

Published: Jun 13, 2026
Updated: Jun 15, 2026
Assigning CNA: WPScan

Primary CVSS

3.4/ 10Low

nvd · CVSS 3.1

CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:N/A:N

EPSS probability estimate

0.5%

Low · next 30 days

Percentile: 41.7%
Model date: Oct 27, 2026

EPSS is a statistical estimate, not a certainty or a measure of impact. Combine it with CVSS, KEV status, exposure and your environment.

Summary

The Store Locator WordPress plugin before 1.6.9 does not validate a parameter before using it in a file path, allowing high-privileged users such as administrators to read arbitrary `.php` files from the server, including configuration files that contain database credentials and authentication keys.

Sources

Repository evidence: Files: 1 · Repositories: 1

1 Template

WordPress Agile Store Locator < 1.6.9 - Arbitrary File ReadTemplate
http/cves/2026/CVE-2026-9062.yaml
Nuclei Templates
DetectionEvidence observed: Oct 26, 2026Revision: 6143fa35504dRelated tool
Declared conditions
- network: http($.protocol_keys)
- verification: dsl($.matchers[*].type)

Responsible use

Use vulnerability information only on systems you own or are authorized to test. Kitploit links to public research metadata and does not store exploit code or malicious payloads.