CVE-2026-9062 Details

A path traversal vulnerability has been identified in the Store Locator WordPress plugin, affecting versions prior to 1.6.9. The vulnerability arises because the plugin does not properly validate a parameter before using it in a file path. This flaw enables high-privileged users, such as administrators, to read arbitrary .php files from the server. Exploitation of this vulnerability could lead to the disclosure of sensitive information, including configuration files that contain database credentials and authentication keys.

Users are advised to update the Store Locator WordPress plugin to version 1.6.9 or later.