CVE-2026-9062 is a CWE-22 path traversal vulnerability in the Store Locator WordPress plugin versions prior to 1.6.9. The plugin fails to properly validate a parameter before using it in a file path, enabling privileged users (e.g., administrators) to read arbitrary .php files from the server. This can lead to disclosure of sensitive information such as database credentials and authentication keys. The vulnerability requires user interaction and high privileges, limiting its exploitation scope. There is no vendor advisory or patch information available at this time.

An attacker with administrator privileges can exploit this vulnerability to read arbitrary .php files on the server, potentially exposing sensitive configuration data including database credentials and authentication keys. This information disclosure could facilitate further attacks or compromise of the system. The vulnerability does not allow code execution or denial of service based on the available data.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict administrator access to trusted users only and monitor for suspicious activity related to file access. Avoid exposing the plugin to untrusted administrators.