# CVE-2026-9062: Agile Store Locator arbitrary file read via path traversal

Source: https://junglewise.ai/threats/cve-2026-9062-agile-store-locator-arbitrary-file-read-via-path-traversal  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-06-13. Updated: 2026-06-13  
License: CC BY 4.0 with a link back

CVE-2026-9062 · Severity: info · CVSS 4.1 · Published 2026-06-13

The Agile Store Locator plugin for WordPress, which helps businesses display physical locations on a map, contains a security flaw that allows administrative users to read sensitive server files. By exploiting this vulnerability, an attacker with high-level access could view the site's configuration files, potentially exposing database passwords and encryption keys. This could lead to a full compromise of the website's data and infrastructure.

Technologies: [AgileLogix Agile Store Locator](https://junglewise.ai/threats/technologies/agile-store-locator). Vendors: [AgileLogix](https://junglewise.ai/threats/vendors/agilelogix).

## Quick answers

**Is CVE-2026-9062 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-9062 being exploited in the wild.

**How severe is CVE-2026-9062?** Informational severity, with a CVSS score of 4.1, published 13 June 2026.

**Which products and versions are affected?** AgileLogix Agile Store Locator < 1.6.9.

**Is there a fix for CVE-2026-9062?** A patch was published on 2026-06-13: Fixed in version 1.6.9 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-9062 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-9062?** Check whether you run AgileLogix Agile Store Locator at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A path traversal vulnerability exists in the Agile Store Locator plugin for WordPress due to insufficient validation of the 'section' parameter in the 'reset_custom_template' and 'load_custom_template' AJAX handlers. An authenticated attacker with administrative privileges can provide a manipulated path (e.g., using '../' sequences) to read the contents of any .php file on the server. Because the application appends a '.php' extension to the input, the attack is limited to PHP files, but this includes critical files like 'wp-config.php' which contains database credentials and authentication salts. The issue is fixed in version 1.6.9.

## Affected products

- AgileLogix Agile Store Locator < 1.6.9

## Timeline

- 2026-05-23: disclosed: Vulnerability publicly published by WPScan
- 2026-06-13: advisory: CVE-2026-9062 published to NVD
- 2026-06-13: patched: Fixed in version 1.6.9

## References

- [https://wpscan.com/vulnerability/14014b6b-ce49-4778-822c-026ecafa1772/](https://wpscan.com/vulnerability/14014b6b-ce49-4778-822c-026ecafa1772/)

## Related threats

- [Agile Store Locator Stored XSS in store logo metadata](https://junglewise.ai/threats/cve-2026-9061-agile-store-locator-stored-xss-in-store-logo-metadata)
- [Agile Store Locator Stored XSS in map_style setting](https://junglewise.ai/threats/cve-2026-9060-agile-store-locator-stored-xss-in-map-style-setting)