low3.4
CVE-2026-9062
The Store Locator WordPress plugin before 1.6.9 does not validate a parameter before using it in a file path, allowing high-privileged users such as administra…
Impact
The Store Locator WordPress plugin before 1.6.9 does not validate a parameter before using it in a file path, allowing high-privileged users such as administrators to read arbitrary `.php` files from the server, including configuration files that contain database credentials and authentication keys.
Affected products
| Product | Affected versions |
|---|---|
| Store Locator WordPress Plugin | before 1.6.9 |
Versions were read from the advisory text. No structured product data has been published for this record yet.