Store Locator WordPress CVE-2026-9062

Exploitation requires an authenticated WordPress administrator account (PR:H per CVSS vector) - the vulnerability is not reachable by lower-privileged roles such as editors or subscribers. The Store Locator WordPress plugin must be installed and active on the target site. The CVSS vector also specifies UI:R, indicating some form of user interaction is involved in triggering the vulnerable code path, consistent with a form submission or deliberate navigation action within the admin panel. Exploitation is constrained to reading files with a .php extension, meaning arbitrary binary files, text configuration files, or private keys stored outside PHP files cannot be directly accessed. The primary limiting factors are the requirement for admin-level authentication and the .php file-type restriction on what can be read. There is no evidence this can be triggered by unauthenticated users or lower-privileged WordPress roles.

Real-world risk is constrained but non-trivial given the nature of what can be read. The CVSS base score of 3.4 (Low) is driven by PR:H (administrator privileges required) and UI:R, which together narrow the exploitable population significantly - an attacker must already control or compromise a WordPress admin account. EPSS at 0.04% and 12th percentile corroborates low exploitation interest in the wild. The SSVC assessment (Exploitation: PoC, Automatable: No, Technical Impact: Partial) aligns with this picture. However, the official CVSS C:L rating arguably undervalues the true confidentiality impact: reading wp-config.php exposes database credentials and authentication secret keys, which can lead to full database access and forged authentication tokens - impacts far exceeding 'low' confidentiality loss. This is a case where a low numeric CVSS score may mislead defenders about the sensitivity of what is actually exposed. The primary risk scenario is a rogue or compromised admin account, insider threat, or a secondary vulnerability chained to obtain admin access before leveraging this path traversal to harvest credentials and pivot further. No KEV listing and low EPSS indicate this is not under widespread active exploitation.

An attacker who holds or has compromised a WordPress administrator account on a site running Store Locator WordPress before 1.6.9 submits a crafted HTTP request to the plugin's admin endpoint, injecting a path traversal sequence (e.g., ../../../../wp-config.php) into the unvalidated file path parameter. The server resolves the traversal and returns the contents of wp-config.php, exposing the database host, username, password, and WordPress secret keys. A public PoC demonstrates this technique, lowering the bar for exploitation once admin access is obtained.