What is the CVSS score of CVE-2026-9062?

CVE-2026-9062 has a CVSS 3.1 base score of 3.4 (Low). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:N/A:N. EPSS exploitation probability: 0.0%.

Is there a public PoC exploit available for CVE-2026-9062?

Yes, a public proof-of-concept exploit is available for CVE-2026-9062. Prioritise patching immediately. EPSS: 0.0%.

Is there a patch available for CVE-2026-9062?

Yes, a patch is available for CVE-2026-9062. Update the affected software to the latest version immediately.

Store Locator WordPress CVE-2026-9062

EUVD-2026-36644 LOW

Path Traversal (CWE-22)

2026-06-13 WPScan

GHSA-553w-8mm7-5gf2

Path Traversal WordPress PHP Store Locator Wordpress

3.4

CVSS 3.1 · Vendor: WPScan

Severity by source

Vendor (WPScan) PRIMARY

3.4 LOW

AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:N/A:N

vuln.today AI

6.8 MEDIUM

Admin-only access warrants PR:H; UI:N because the admin is the attacker acting directly; C:H because wp-config.php exposure yields full database credentials and auth keys.

3.1 AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (WPScan).

CVSS VectorVendor: WPScan

CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:N/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

Required

Scope

Changed

Confidentiality

Low

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 23, 2026 - 17:02 vuln.today

Patch available

Jun 13, 2026 - 08:01 EUVD

CVE Published

Jun 13, 2026 - 06:00 cve.org

LOW 3.4

CVE Published

Jun 13, 2026 - 06:00 cve.org

UNKNOWN (no severity yet)

DescriptionCVE.org

The Store Locator WordPress plugin before 1.6.9 does not validate a parameter before using it in a file path, allowing high-privileged users such as administrators to read arbitrary .php files from the server, including configuration files that contain database credentials and authentication keys.

AnalysisAI

Path traversal in the Store Locator WordPress plugin before version 1.6.9 enables authenticated administrators to read arbitrary PHP files from the server filesystem, including wp-config.php, which contains database credentials and WordPress secret keys. The vulnerability stems from an unvalidated parameter passed directly into a file path, allowing traversal sequences to escape the intended directory. A publicly available proof-of-concept exists per WPScan reporting, though EPSS sits at 0.04% (12th percentile) and no KEV listing exists, indicating low observed exploitation activity despite the public PoC.

Technical ContextAI

The root cause is CWE-22 (Improper Limitation of a Pathname to a Restricted Directory - Path Traversal): the plugin accepts a user-controlled parameter and interpolates it into a filesystem read operation without sanitizing directory traversal sequences (e.g., ../../). This is a classic PHP path traversal pattern common in WordPress plugins that dynamically include or read files based on request parameters. The CPE cpe:2.3:a:unknown:store_locator_wordpress:*:*:*:*:*:*:*:* covers all versions of the plugin up to 1.6.9. The CVSS scope change (S:C) reflects that the vulnerable component - the plugin sandbox - can read files belonging to the broader server environment, including the WordPress core configuration file wp-config.php, which sits outside the plugin's own file scope. The disclosed impact on PHP files specifically suggests the plugin performs a PHP file read or include operation rather than a generic file read, limiting but not eliminating the severity.

RemediationAI

Update the Store Locator WordPress plugin to version 1.6.9 or later, which contains the vendor-released patch. The fix is confirmed as available per vendor advisory; the exact patch can be obtained through the WordPress plugin repository or via the WPScan advisory at https://wpscan.com/vulnerability/14014b6b-ce49-4778-822c-026ecafa1772/. If an immediate update is not possible, a compensating control is to restrict access to the WordPress admin panel (wp-admin) to trusted IP ranges via web server configuration or a security plugin, reducing exposure to admin-level exploitation - note this does not eliminate the vulnerability if admin credentials are already compromised. Additionally, auditing which users hold administrator roles and reducing that set to the minimum necessary limits the population of potential abusers. There are no known workarounds that address the root cause without patching.