Description

The WP Maps – Google Maps,OpenStreetMap,Mapbox,Store Locator,Listing,Directory & Filters plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 4.9.8 via the 'page' parameter parameter. This makes it possible for authenticated attackers, with subscriber-level access and above, to include and execute arbitrary .php files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where .php file types can be uploaded and included.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.5",
  "pubDate": "2026-09-25T08:16:39.970Z",
  "pubdate": "2026-09-25T08:16:39.970Z",
  "executiveSummary": "The WP Maps plugin for WordPress, in versions up to and including 4.9.8, contains a Local File Inclusion (LFI) vulnerability.\nThis security flaw allows an authenticated attacker, possessing subscriber-level permissions or higher, to include and execute arbitrary PHP files residing on the server filesystem.\nThe vulnerability resides within the processing logic of the 'page' parameter, which fails to adequately sanitize or validate user-supplied input before using it in file inclusion functions.\nBy manipulating the 'page' parameter, an attacker can perform path traversal or target specific local files to trigger arbitrary code execution.\nThe impact is critical, as it facilitates unauthorized access to sensitive data, bypasses authentication and authorization controls, and enables full remote code execution (RCE) on the underlying web server if the attacker can place a malicious PHP file on the system (e.g., via a separate file upload vector).\nGiven that this vulnerability requires only subscriber-level authentication, the attack surface is significantly expanded, necessitating immediate remediation efforts to prevent potential system compromise.",
  "technicalDetails": "The vulnerability is a Local File Inclusion (LFI) flaw identified within the 'WP Maps' plugin, affecting all versions up to and including 4.9.8. The root cause is improper input validation and sanitization of the 'page' parameter utilized within the plugin's core functionality.\nIn WordPress plugin development, local file inclusion occurs when an application takes user input and passes it directly into a filesystem inclusion function—such as 'include()', 'include_once()', 'require()', or 'require_once()'—without verifying that the requested file resides within an expected, safe directory. In this instance, the plugin fails to implement necessary checks (e.g., using 'realpath()' to validate the destination path or utilizing an allowlist of permitted files) on the 'page' parameter.\nAn attacker with subscriber-level access or higher can exploit this by crafting a request that manipulates the 'page' parameter to point to arbitrary files on the server filesystem. By utilizing path traversal techniques (e.g., injecting '../' sequences), the attacker can escape the intended directory and access sensitive configuration files, system files, or uploaded files. If an attacker can upload a malicious file containing PHP code—perhaps through another vulnerability or an intended plugin feature—they can use this LFI flaw to trigger the execution of that code by including the file via the vulnerable parameter.\nThe attack flow is as follows: 1) The attacker authenticates as a subscriber or higher. 2) The attacker identifies the vulnerable endpoint processing the 'page' parameter. 3) The attacker submits a specially crafted request (typically a GET or POST request) where the 'page' parameter contains a path to a malicious or targeted file. 4) The plugin code consumes this parameter and passes it to an inclusion function. 5) The server-side interpreter loads and executes the content of the referenced file as PHP code. 6) Post-exploitation, the attacker gains the ability to interact with the server environment with the same privileges as the web server user, potentially leading to full system compromise, exfiltration of credentials, database modification, or the installation of persistent web shells."
}