WP Maps EUVD-2026-54391

Exploitation requires a valid WordPress Subscriber-level account on the target site - confirmed by CVSS PR:L. Open user registration (WordPress default on many sites) allows any internet user to self-register and immediately exploit the vulnerability. The vulnerable AJAX action must be reachable via HTTP/HTTPS (standard for any internet-facing WordPress installation). The LFI payload must reference an existing PHP file on the server filesystem - the attacker cannot upload new files through this vector alone, so impact depends on what PHP-interpretable files already exist locally (e.g., uploaded media with embedded PHP, PHP session files, or log files). SSVC designates this as 'Automatable: no' specifically because account acquisition cannot be fully automated. Exploitation is limited to: authenticated sessions only (no unauthenticated path), existing local file targets only (cannot introduce new payloads via this flaw alone), and environments where Subscriber registration is permitted or credentials are obtainable.

The CVSS 8.8 score with vector AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H reflects a genuinely serious vulnerability: network-reachable, low complexity, requiring only Subscriber-level credentials, with total CIA impact. The low privilege requirement (Subscriber) is especially dangerous on WordPress sites that allow open user registration, which is a common configuration. Countering this severity signal, the EPSS of 0.30% (23rd percentile) suggests that automated, widespread exploitation is not currently occurring - consistent with SSVC's 'Automatable: no' designation, since account acquisition is a prerequisite that prevents fully automated spray attacks. The SSVC technical impact is rated 'total,' aligning with CVSS's C:H/I:H/A:H. No KEV listing means active exploitation is not confirmed by CISA at time of analysis. The gap between CVSS severity and low EPSS is explained by the authentication barrier - the attack is not trivially automatable at scale, but for any site with open registration or where credentials can be obtained, this represents a critical path to full server compromise. A public POC from WPScan elevates urgency above the EPSS alone would suggest.

An attacker registers a free Subscriber account on a WordPress site running WP Maps before 4.9.7 (or uses compromised Subscriber credentials), then sends a crafted AJAX POST request to wp-admin/admin-ajax.php with a path traversal payload targeting a known server-side PHP file - such as a previously uploaded image file with embedded PHP code or a world-readable configuration file. A public proof-of-concept for this vulnerability is available via WPScan, lowering the technical barrier. Because the AJAX handler performs no capability check and no path validation, the server includes and executes the targeted file under the web server process's privileges.