EUVD-2026-30732
GHSA-2mmr-f4v7-mvfx
Severity by source
AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
Network-reachable LFI needing only a low-priv account (PR:L); traversal is straightforward (AC:L); primary impact is arbitrary file read (C:H), with limited integrity and no direct availability impact absent confirmed code execution.
Primary rating from NVD.
CVSS VectorNVD
Lifecycle Timeline
4DescriptionCVE.org
The WP Maps WordPress plugin before 4.9.3 does not properly sanitize a parameter before using it in a file path, allowing authenticated users to perform Local File Inclusion attacks.
AnalysisAI
Local File Inclusion in the WP Maps WordPress plugin before 4.9.3 allows authenticated users to read arbitrary files by injecting path traversal sequences into an unsanitized parameter used to build a file path. Publicly available exploit code exists (reported by WPScan), though EPSS is low (0.03%, 8th percentile) and the flaw is not automatable per SSVC. A vendor patch is available in version 4.9.3.
Technical ContextAI
WP Maps is a mapping/Google Maps plugin for the WordPress CMS (PHP). The vulnerability is a classic CWE-22 Improper Limitation of a Pathname to a Restricted Directory (Path Traversal) leading to Local File Inclusion: a user-controlled parameter is concatenated into a filesystem path without sanitization or canonicalization, so traversal sequences (e.g. ../../) or absolute paths let the attacker escape the intended directory. Depending on how the resolved path is consumed (include/require vs read), this can expose sensitive files such as wp-config.php or, if PHP files under attacker influence can be included, lead to code execution. The affected CPE is cpe:2.3:a:unknown:wp_maps:*:*:*:*:*:*:*:* (vendor unidentified in NVD).
RemediationAI
Vendor-released patch: WP Maps 4.9.3 - upgrade all WordPress installations running this plugin to 4.9.3 or later as the primary fix. Consult the WPScan advisory (https://wpscan.com/vulnerability/18b36672-58d7-44fa-b653-b728e9ef257a/) and NVD entry (https://nvd.nist.gov/vuln/detail/CVE-2026-6381) for confirmation. If immediate patching is not possible, reduce exposure by restricting who holds authenticated accounts on the site (the flaw needs a low-privileged authenticated user), and deploy a WAF rule to block path-traversal patterns (../, encoded %2e%2e, and absolute paths) on the vulnerable parameter/endpoint; note this WAF approach can be bypassed by novel encodings and may false-positive on legitimate map data. As a stronger interim control, deactivate the WP Maps plugin until it is updated - the trade-off is loss of map functionality on affected pages.
Local file inclusion via path traversal in WP Maps WordPress plugin (before 4.9.7) allows any authenticated Subscriber-l
Unvalidated input in the WP Google Map Plugin WordPress plugin, versions before 4.1.5, in the Manage Locations page with
Denial of Service in the WP Maps WordPress plugin before 4.9.7 allows any authenticated subscriber to exhaust server res
Unauthenticated SQL injection in the WP Maps WordPress plugin (versions 4.9.1 and earlier, by Flipper Code) allows remot
The WP Maps WordPress plugin before 4.7.2 does not sanitise and escape some of its Map settings, which could allow high
The WP Maps WordPress plugin before 4.7.2 does not sanitise and escape some of its Map settings, which could allow high
The WP Maps WordPress plugin before 4.7.2 does not sanitise and escape some of its Map settings, which could allow high
Cross-Site Request Forgery (CSRF) vulnerability in flippercode WordPress Plugin for Google Maps - WP MAPS (formerly WP G
Cross-Site Request Forgery (CSRF) vulnerability affecting Delete Marker Category, Delete Map, and Copy Map functions in
The WP Google Map WordPress plugin before 1.7.7 did not sanitise or escape the Map Title before outputting them in the p
Auth. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. No vendor pat
Sensitive data exposure in the WP Maps WordPress plugin (versions through 4.9.6) allows authenticated low-privilege user
Same weakness CWE-22 – Path Traversal
View allSame technique Path Traversal
View allShare
External POC / Exploit Code
Leaving vuln.today