/Vulnerability Library

WordPress Agile Store Locator < 1.6.9 - Arbitrary File Read

CVE-2026-9062
Early Release

Description

The Agile Store Locator WordPress plugin before 1.6.9 does not validate a parameter before using it in a file path, allowing high-privileged users such as administrators to read arbitrary .php files from the server.

Severity

Low

CVSS Score

3.4

Exploit Probability

0%

Affected Product

agile-store-locator

Published Date

October 20, 2026

Template Author

anirbala98

CVE-2026-9062.yaml
3.4Score

CVSS Metrics

CVSS Vector:
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:N/A:N
CVE ID:
cve-2026-9062
CWE ID:
cwe-22

References

https://wpscan.com/vulnerability/14014b6b-ce49-4778-822c-026ecafa1772/https://wordpress.org/plugins/agile-store-locator/https://nvd.nist.gov/vuln/detail/CVE-2026-9062

Remediation Steps

Update to version 1.6.9 or later.