CVE-2026-13456 flippercode CVE debrief

Who should care

WordPress site administrators, security teams, and developers using the WP Maps plugin should assess exposure and apply patches or mitigations to prevent potential code execution and data breaches.

Why it matters

CVE-2026-13456 is a high-severity vulnerability in the WP Maps plugin for WordPress, allowing Local File Inclusion and PHP code execution. WordPress site administrators and security teams should assess exposure and apply patches or mitigations to prevent potential code execution and data breaches.

• Code execution in PHP files can lead to unauthorized access and data breaches
• Bypassing access controls can allow attackers to perform actions as if they were administrators
• Obtaining sensitive data can compromise site security and user data
• Verification of patch application and vulnerability remediation is necessary

Technical summary

The WP Maps – Google Maps, OpenStreetMap, Mapbox, Store Locator, Listing, Directory & Filters plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 4.9.8 via the 'page' parameter. Authenticated attackers with subscriber-level access and above can include and execute arbitrary .php files on the server, allowing PHP code execution. This vulnerability allows attackers to bypass access controls, obtain sensitive data, or achieve code execution in cases where .php file types can be uploaded and included. WordPress site administrators and security teams should assess exposure and apply patches or mitigations to prevent potential code execution and data breaches.

Defensive priority

High priority for WordPress site administrators and security teams to assess exposure and apply patches or mitigations.

Recommended defensive actions

• Assess exposure of WP Maps plugin versions up to 4.9.8
• Apply patches or updates to WP Maps plugin
• Monitor for suspicious activity related to Local File Inclusion
• Verify access controls and authentication mechanisms
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE record and NVD entry provide details on the vulnerability, including its CVSS score of 7.5 and HIGH severity. The WP Maps plugin is vulnerable to Local File Inclusion, allowing authenticated attackers to execute arbitrary PHP code.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.