PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-6381 WP Maps CVE debrief

CVE-2026-6381 is a Local File Inclusion (LFI) vulnerability in the WP Maps WordPress plugin, affecting versions prior to 4.9.3. The vulnerability stems from improper sanitization of a user-supplied parameter used in file path construction, allowing authenticated attackers to include arbitrary files from the server's filesystem. The CVSS 3.1 vector (AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H) indicates network attack vector, high attack complexity, low privileges required, no user interaction, and high impacts to confidentiality, integrity, and availability. The vulnerability was published to NVD on 2026-05-18 and carries a HIGH severity rating with a CVSS score of 7.5. The weakness is classified as CWE-22 (Improper Limitation of a Pathname to a Restricted Directory). No known exploitation in ransomware campaigns has been documented, and the vulnerability is not listed in CISA's Known Exploited Vulnerabilities catalog.

Vendor
WP Maps
Product
WP Maps WordPress plugin
CVSS
HIGH 7.5
CISA KEV
Not listed in stored evidence
Original CVE published
2026-05-18
Original CVE updated
2026-05-18
Advisory published
2026-05-18
Advisory updated
2026-05-18

Who should care

WordPress site administrators using WP Maps plugin; security teams managing WordPress estates; web application security assessors; managed service providers hosting WordPress environments

Technical summary

The WP Maps plugin fails to sanitize a parameter before using it in a file path, enabling authenticated Local File Inclusion. Attackers with low-privilege accounts can potentially read sensitive files (wp-config.php, /etc/passwd) or achieve code execution through log file poisoning or PHP session file inclusion. The high attack complexity (AC:H) suggests exploitation may require specific conditions or multiple steps.

Defensive priority

HIGH

Recommended defensive actions

  • Upgrade WP Maps WordPress plugin to version 4.9.3 or later
  • Review WordPress user accounts for unauthorized privilege escalation or suspicious file access patterns
  • Implement Web Application Firewall (WAF) rules to detect and block path traversal sequences in plugin parameters
  • Enable comprehensive logging for file inclusion operations in WordPress environments
  • Conduct code review of custom WP Maps integrations for additional sanitization gaps
  • Restrict WordPress administrative access to trusted IP ranges where feasible

Evidence notes

Vulnerability description sourced from NVD official record. CVSS vector and CWE classification from NVD source item metadata. WPScan reference link provided as primary technical source. Vendor identification marked as low confidence with review flag due to 'Unknown Vendor' classification in source data.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-6381 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-6381

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-6381 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-6381

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.