CVE-2026-9062: Store Locator WordPress Plugin Path Traversal Allows Sensitive File Read

Technical summary

CVE-2026-9062 is a path traversal vulnerability (CWE-22) in the Store Locator WordPress plugin. The plugin fails to validate a user-supplied parameter before incorporating it into a file path operation, enabling arbitrary file read access. The CVSS v3.1 score is 3.4 (LOW), reflecting a network-accessible attack vector, low attack complexity, high privilege requirement, and user interaction necessity. The vulnerability results in confidentiality loss without integrity or availability impact.

Business impact

Exploitation could expose sensitive configuration data, including database credentials, WordPress security keys, and authentication tokens. For organizations relying on this plugin, a compromised administrator account—whether through phishing, credential reuse, or insider activity—becomes a vector for extracting infrastructure secrets that could enable lateral movement or persistent access. The actual business risk depends on how tightly access controls are enforced and whether configuration files are stored in web-accessible directories.

Affected systems

The Store Locator WordPress plugin is affected in all versions prior to 1.6.9. Any WordPress installation running an older version of this plugin with an administrator user is potentially at risk. Organizations should verify their current plugin version and deployment scope across their WordPress estate.

Exploitability

Exploitation requires high-privileged access (WordPress administrator role) and user interaction (likely a click or navigation action), significantly constraining real-world attack surface. The vulnerability is not trivial to weaponize without an existing admin foothold. However, once admin credentials are compromised—a common outcome of social engineering or credential stuffing—exploitation becomes straightforward and requires no advanced techniques.

Remediation

Update the Store Locator WordPress plugin to version 1.6.9 or later. Administrators should also review access logs for suspicious file read patterns, audit who holds administrator privileges, and consider enforcing strong password policies and multi-factor authentication for all admin accounts. In parallel, ensure database credentials and configuration files are not stored in or linked from web-accessible directories.

Patch guidance

Upgrade the Store Locator WordPress plugin to version 1.6.9 or later through the WordPress plugin management interface or by manual download from the official plugin repository. Test the update in a staging environment before deploying to production. Verify that the plugin continues to function with your site configuration after patching.

Detection guidance

Monitor access logs for administrator accounts reading unusual file paths, especially patterns consistent with directory traversal (e.g., requests with `../` sequences or absolute paths to sensitive files). WordPress security plugins and file integrity monitoring tools can flag unexpected file access by plugins. Inspect admin user activity logs for access to configuration pages or API endpoints that might indicate reconnaissance. Review web server logs for HTTP requests targeting the Store Locator plugin with suspicious parameters.

Why prioritize this

Although the CVSS score is LOW (3.4), this vulnerability warrants timely attention because it directly exposes secrets that could be leveraged for wider compromise. The requirement for admin access means it is not an immediate mass-exploitation vector, but the consequences of exposure are material. Prioritize patching based on your organization's control over admin account access and the sensitivity of what might be read from your server's configuration.

Risk score, explained

The CVSS 3.1 score of 3.4 reflects the attack vector (network-accessible), low complexity, high privilege requirement, user interaction requirement, and confidentiality impact. The score appropriately de-emphasizes this vulnerability for most organizations because the admin-only prerequisite is a significant gating factor. However, the LOW score should not be mistaken for 'low business risk'—disclosure of configuration secrets can have outsized impact relative to the numerical score.

Frequently asked questions