The WP Maps WordPress plugin before 4.9.7 does not perform a capability check in one of its AJAX actions and does not properly validate a user-controlled path before using it in a file inclusion, allowing users with a Subscriber account to include and execute arbitrary existing local PHP files on the server. This vulnerability, with a CVSS score of 8.8 and considered HIGH severity, enables attackers to ex [truncated]
CVE-2026-6381 is a Local File Inclusion (LFI) vulnerability in the WP Maps WordPress plugin, affecting versions prior to 4.9.3. The vulnerability stems from improper sanitization of a user-supplied parameter used in file path construction, allowing authenticated attackers to include arbitrary files from the server's filesystem. The CVSS 3.1 vector (AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H) indicates network at [truncated]
