PatchSiren

WP Maps CVE debriefs

These pages are published after PatchSiren validates generated defensive summaries against stored public CVE and source evidence.

HIGH WP Maps CVE published 2026-05-18

CVE-2026-6381

CVE-2026-6381 is a Local File Inclusion (LFI) vulnerability in the WP Maps WordPress plugin, affecting versions prior to 4.9.3. The vulnerability stems from improper sanitization of a user-supplied parameter used in file path construction, allowing authenticated attackers to include arbitrary files from the server's filesystem. The CVSS 3.1 vector (AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H) indicates network at [truncated]