Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
3.4

Store Locator WordPress plugin exposes sensitive files to admins

CVE-2026-9062 · published 4 months ago
Summary

The Store Locator WordPress plugin is affected if you're using version 1.6.8 or earlier. This means that high-privileged users, like administrators, can access sensitive files on your server, including those that contain database credentials and authentication keys. To fix this, update the plugin to version 1.6.9 or later.

Original advisory text
The Store Locator WordPress plugin before 1.6.9 does not validate a parameter before using it in a file path, allowing high-privileged users such as administrators to read arbitrary `.php` files fr...
The Store Locator WordPress plugin before 1.6.9 does not validate a parameter before using it in a file path, allowing high-privileged users such as administrators to read arbitrary `.php` files from the server, including configuration files that contain database credentials and authentication keys.
References
Fix within
Internet-facing 60 days
Internal At next upgrade
  • Not known to be exploited
  • Needs hands-on effort to exploit
  • Gives an attacker partial control
Severity
3.4 Low
Exploitation
<1% chance of attack within 30 days
Type
CWE-22Path Traversal
Timeline
Published13 Jun 2026
Updated3 Nov 2026
First seen13 Jun 2026
Sources
CVE-2026-9062 · NVD
Track software like this
Free during beta