Easy Google Maps CVE-2026-73367

No authentication is required, as confirmed by the CVSS vector metrics PR:N and UI:N. Exploitation requires only that the target WordPress site has the Easy Google Maps plugin installed and active at a version below 1.14.2 - no special feature toggle, non-default configuration, or specific deployment mode is needed beyond plugin activation. The server's PHP runtime must permit outbound HTTP/HTTPS connections for a remote payload to be fetched (classic RFI); environments with allow_url_include=Off or egress firewall rules blocking outbound HTTP from the web server process will impede but may not fully eliminate impact, particularly if the vulnerability can also be exploited for local file disclosure. The scope change (S:C) additionally requires no special conditions - it reflects the inherent nature of WordPress's shared execution context across plugins.

The CVSS 3.1 vector AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N presents the lowest possible exploitation barrier - network-reachable, no complexity, no authentication, no user interaction - which is the most dangerous profile class regardless of the score. The scope change elevates the effective blast radius beyond the plugin itself. However, the capped impact metrics (C:L/I:L, A:N) indicate this does not constitute full remote code execution in the classical sense; exploitation yields partial information disclosure and limited integrity impact. No EPSS data was supplied, and no KEV listing or POC code is present in the available intelligence, suggesting active exploitation is not currently confirmed. Real-world risk is moderate-to-significant: WordPress is ubiquitously deployed and plugin update hygiene is historically poor across self-managed sites, meaning a large proportion of vulnerable installs may persist unpatched. The absence of a severity floor above 7.2 despite the full-open CVSS profile is consistent with the limited C:L/I:L impact bounds, and this should not be read as low urgency.

An unauthenticated attacker identifies a WordPress site running Easy Google Maps below 1.14.2 and sends a crafted GET or POST request to a plugin endpoint, supplying a remote URL as the value of a file path parameter. The plugin passes the attacker-supplied value directly to a PHP include or require call, causing the server to fetch the attacker's remote resource and execute or expose its contents within the WordPress process. No public POC code has been identified at time of analysis, but the low complexity (AC:L) and absence of any authentication barrier mean exploitation is straightforward once the vulnerable parameter is identified.