3.4
Low
CVE-2026-9062 The Store Locator WordPress plugin before 1.6.9 does not validate a parameter before using it in a file path, allowing…
Description
The Store Locator WordPress plugin before 1.6.9 does not validate a parameter before using it in a file path, allowing high-privileged users such as administrators to read arbitrary `.php` files from the server, including configuration files that contain database credentials and authentication keys.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| Store Locator WordPress 1.6 | earliest → < 1.6.9 | 1.6.9 |
Other CVEs of Store Locator WordPress
The 5 CVEs of Store Locator WordPress →
CVE-2026-9061
The Store Locator WordPress plugin before 1.6.9 does not sanitize and escape store logo metadata before storing it and…
3.5
Low
CVE-2026-9060
The Store Locator WordPress plugin before 1.6.6 does not sanitize and escape one of its settings before storing it and…
3.5
Low
CVE-2023-4151
The Store Locator WordPress plugin before 1.4.13 does not sanitise and escape an invalid nonce before outputting it back…
6.1
Medium
CVE-2022-4832
The Store Locator WordPress plugin before 1.4.9 does not validate and escape some of its shortcode attributes before…
5.4
Medium