Quick answers
- Is CVE-2026-9062 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-9062 being exploited in the wild.
- How severe is CVE-2026-9062?
- Informational severity, with a CVSS score of 4.1, published 13 June 2026.
- Which products and versions are affected?
- AgileLogix Agile Store Locator < 1.6.9.
- Is there a fix for CVE-2026-9062?
- A patch was published on 2026-06-13: Fixed in version 1.6.9 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2026-9062 attacked?
- It is attacked over the network, in a software library.
- Am I affected by CVE-2026-9062?
- Check whether you run AgileLogix Agile Store Locator at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
A path traversal vulnerability exists in the Agile Store Locator plugin for WordPress due to insufficient validation of the 'section' parameter in the 'reset_custom_template' and 'load_custom_template' AJAX handlers. An authenticated attacker with administrative privileges can provide a manipulated path (e.g., using '../' sequences) to read the contents of any .php file on the server. Because the application appends a '.php' extension to the input, the attack is limited to PHP files, but this includes critical files like 'wp-config.php' which contains database credentials and authentication salts. The issue is fixed in version 1.6.9.
Affected products
- AgileLogix Agile Store Locator < 1.6.9
Timeline
- 2026-05-23: disclosed: Vulnerability publicly published by WPScan
- 2026-06-13: advisory: CVE-2026-9062 published to NVD
- 2026-06-13: patched: Fixed in version 1.6.9