EUVD-2026-60789
GHSA-9q3x-m6g6-vvr5
Severity by source
AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N
Unauthenticated network exploitation with no complexity (PR:N, AV:N, AC:L); scope change to WordPress platform justified; C:L/I:L reflects partial RFI impact without confirmed full code execution.
Primary rating from Vendor (Patchstack).
CVSS VectorVendor: Patchstack
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N
Lifecycle Timeline
3DescriptionCVE.org
Unauthenticated Remote File Inclusion in Easy Google Maps < 1.14.2 versions.
AnalysisAI
Remote File Inclusion in the Easy Google Maps WordPress plugin (versions below 1.14.2) by Supsystic exposes unauthenticated remote attackers to include arbitrary external files into the server-side execution context with no credentials or user interaction required. The CVSS scope change (S:C) indicates impact extends beyond the plugin itself to the broader WordPress installation, enabling limited confidentiality and integrity compromise. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | No authentication is required, as confirmed by the CVSS vector metrics PR:N and UI:N. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.1 vector AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N presents the lowest possible exploitation barrier - network-reachable, no complexity, no authentication, no user interaction - which is the most dangerous profile class regardless of the score. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An unauthenticated attacker identifies a WordPress site running Easy Google Maps below 1.14.2 and sends a crafted GET or POST request to a plugin endpoint, supplying a remote URL as the value of a file path parameter. The plugin passes the attacker-supplied value directly to a PHP include or require call, causing the server to fetch the attacker's remote resource and execute or expose its contents within the WordPress process. … |
| Remediation | Update the Easy Google Maps plugin to version 1.14.2 or later immediately, as this is the vendor-released patch confirmed by the Patchstack advisory (https://patchstack.com/database/wordpress/plugin/google-maps-easy/vulnerability/wordpress-easy-google-maps-plugin-1-14-2-remote-file-inclusion-vulnerability). … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, identify all WordPress instances using Easy Google Maps and verify installed versions; immediately apply Web Application Firewall rules or server-level rules (via .htaccess or web server configuration) blocking file inclusion patterns targeting the plugin directory. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Easy Google Maps
View allUnauthenticated PHP object injection affects the Easy Google Maps WordPress plugin (vendor Supsystic) in all versions up
Cross-Site Request Forgery (CSRF) vulnerability in Supsystic Easy Google Maps plugin <= 1.11.7 versions. Rated high seve
The Google Maps Easy WordPress plugin is vulnerable to Stored Cross-Site Scripting due to insufficient input validation
The Easy Google Maps plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's file upload feat
The Easy Google Maps plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including,
Cross-Site Request Forgery (CSRF) vulnerability in Supsystic Easy Google Maps.11.11. Rated medium severity (CVSS 4.3), t
Same technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today