What is the CVSS score of CVE-2026-18465?

CVE-2026-18465 has a CVSS 3.1 base score of 6.5 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N. EPSS exploitation probability: 0.3%.

Is there a patch available for CVE-2026-18465?

Yes, a patch is available for CVE-2026-18465. Update the affected software to the latest version immediately.

WP Maps Pro CVE-2026-18465

EUVD-2026-54879 MEDIUM

Path Traversal (CWE-22)

2026-08-09 contact@wpscan.com

GHSA-mcpf-p8j2-92hw

PHP WordPress Path Traversal

6.5

CVSS 3.1 · Vendor: wpscan

Severity by source

Vendor (wpscan) PRIMARY

6.5 MEDIUM

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

vuln.today AI

9.1 CRITICAL

Unauthenticated network exploitation; inclusion of wp-config.php exposes credentials (C:H); executing existing PHP server-side achieves full integrity impact (I:H); no availability impact described.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (wpscan).

CVSS VectorVendor: wpscan

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Aug 10, 2026 - 20:30 vuln.today

CVSS changed

Aug 10, 2026 - 20:22 NVD

6.5 (MEDIUM)

Patch available

Aug 09, 2026 - 07:16 EUVD

CVE Published

Aug 09, 2026 - 06:19 cve.org

UNKNOWN (no severity yet)

CVE Published

Aug 09, 2026 - 06:19 cve.org

MEDIUM 6.5

DescriptionCVE.org

The WP MAPS PRO WordPress plugin before 6.1.3 does not perform a capability check in one of its AJAX actions, which is also available to unauthenticated users, and does not properly validate a user-controlled path before using it in a file inclusion, allowing unauthenticated attackers to include and execute arbitrary existing local PHP files on the server.

AnalysisAI

Local file inclusion in WP Maps Pro (all versions before 6.1.3) allows unauthenticated remote attackers to include and execute arbitrary existing PHP files on the server by exploiting an AJAX action that lacks both a capability check and path sanitization. Any internet-exposed WordPress installation running the affected plugin is susceptible with no authentication, user interaction, or special configuration required. No public exploit identified at time of analysis and EPSS is low (0.32%), but the zero-barrier entry point and code execution potential elevate the real-world priority well above what the CVSS 6.5 score implies.

Technical ContextAI

WordPress plugins register AJAX handlers using the wp_ajax_nopriv_* hook to serve unauthenticated callers, or wp_ajax_* for authenticated sessions. In vulnerable versions of WP Maps Pro, one such action is exposed to unauthenticated users (via wp_ajax_nopriv_* or equivalent) and omits the standard current_user_can() capability gate. The action then passes a user-controlled parameter directly into a PHP file-inclusion construct (include(), require(), or variants) without stripping path traversal sequences (../) or confining the lookup to a safe directory. This is classified under CWE-22 (Improper Limitation of a Pathname to a Restricted Directory - Path Traversal). Because the inclusion target must be an existing PHP file on the local filesystem, the attacker can reach sensitive files such as wp-config.php (which contains database credentials) or any other accessible PHP file, causing the server to execute their contents in the web server process context. No CPE string was provided in the source intelligence.

RemediationAI

The primary fix is to upgrade WP Maps Pro to version 6.1.3 or later immediately via the WordPress plugin dashboard or by downloading from the vendor. This is the vendor-released patch confirmed by WPScan and EUVD. If immediate patching is not feasible, a compensating control is to temporarily deactivate the plugin entirely - note that this removes all mapping functionality served by the plugin. Alternatively, restrict unauthenticated POST requests to /wp-admin/admin-ajax.php at the web server or WAF layer, filtering requests that contain path traversal sequences (../, ..%2F) in any parameter; be aware this may interfere with legitimate plugin AJAX calls for authenticated users and requires careful rule tuning. Do not rely solely on WAF filtering as a long-term control - patch to 6.1.3 as soon as possible. References: https://wpscan.com/vulnerability/53da3a6d-1eab-4f61-ba61-fa7a04d2205a/ and https://nvd.nist.gov/vuln/detail/CVE-2026-18465.