CVE-2026-9062 | Agile Store Locator < 1.6.9 - Admin+ Arbitrary File Read via Path Traversal

The Store Locator WordPress plugin before 1.6.9 does not validate a parameter before using it in a file path, allowing high-privileged users such as administrators to read arbitrary `.php` files from the server, including configuration files that contain database credentials and authentication keys.

Published: 2026-06-13 Last update: 2026-06-13 Assigner: [email protected] Source: [email protected]
NVD Status：Received，CVE State: published
View at NVD, CVE.org, EUVD

CVE-2026-9062 is rated Low Risk (12.5/100): low exploitation likelihood (EPSS 0.04%). Low composite risk—no urgent action required; patch on your normal maintenance cycle and revisit priority if CVSS or EPSS increases.

Risk is dynamic; we continuously reassess and refresh what is shown on this page as upstream context changes.

Exploit prediction scoring system (EPSS) score for CVE-2026-9062

EPSS lead: Daily EPSS estimates relative likelihood of exploitation; percentile ranks this CVE among scored vulnerabilities (higher = more severe relative rank).

# Date Old EPSS score New EPSS score Delta (New - Old)
1 2026-06-13 — 0.04% —

Full EPSS history (1 record total)

Common vulnerability scoring system (CVSS) metrics for CVE-2026-9062

CVSS metrics for this CVE.

No CVSS data in dataset for this CVE.

Weakness enumeration for CVE-2026-9062

GitHub Security Advisory for CVE-2026-9062

GHSA-553w-8mm7-5gf2 · Severity: unknown — The Store Locator WordPress plugin before 1.6.9 does not validate a parameter before using it in...

Affected software / configurations for CVE-2026-9062

Vendor Product Version Raw CPE
No affected products in dataset.

References for CVE-2026-9062

cvelogic Threat Intelligence