Description

The WP Maps WordPress plugin before 4.9.7 does not perform a capability check in one of its AJAX actions and does not properly validate a user-controlled path before using it in a file inclusion, allowing users with a Subscriber account to include and execute arbitrary existing local PHP files on the server.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.8",
  "pubDate": "2026-08-07T06:16:56.500Z",
  "pubdate": "2026-08-07T06:16:56.500Z",
  "executiveSummary": "The WP Maps WordPress plugin before 4.9.7 contains a security vulnerability involving local file inclusion via an AJAX action. The flaw stems from a complete lack of authorization checks coupled with insufficient sanitization and validation of user-controlled input paths. This allows low-privileged users, specifically authenticated attackers holding a Subscriber account, to leverage the administrative AJAX functionality to perform arbitrary local file inclusion attacks.\nThe primary impact of this vulnerability is Remote Code Execution (RCE). By leveraging the inclusion mechanism, an authenticated attacker with minimal privileges can execute arbitrary local PHP files already present on the underlying server. Depending on the server configuration and the presence of accessible files containing executable code or log data, this can lead to full system compromise, data exfiltration, or further lateral movement within the hosting environment.\nThe affected system is the WP Maps WordPress plugin across all versions prior to 4.9.7. The risk implication is severe because the vulnerability lowers the exploitation threshold from unauthenticated to authenticated low-privileged access, bypassing intended role-based access control boundaries within the WordPress application. Remediation requires updating the plugin to version 4.9.7 or later, where proper capability checks and input validation are implemented.",
  "technicalDetails": "The root cause of the vulnerability resides in the AJAX handling architecture of the WP Maps plugin prior to version 4.9.7. Specifically, the affected AJAX action fails to invoke authorization validation routines, such as checking user capabilities via current_user_can(), before processing incoming requests. Furthermore, the endpoint accepts a user-controlled parameter representing a file path without adequately validating, sanitizing, or restricting it against a whitelist of permissible resources.\nThe vulnerable component is the AJAX action handler within the plugin that processes file inclusion requests. Because the endpoint does not enforce capability checks, any authenticated user, including those registered with the lowest privilege tier of Subscriber, can trigger the AJAX request. The attack flow begins when an attacker crafts an HTTP request targeting the WordPress admin-ajax.php endpoint with the appropriate action parameter associated with the WP Maps plugin.\nDuring the request handling, the application takes the user-supplied path parameter and passes it directly into a file inclusion function without proper path traversal defense or strict directory restriction. Consequently, the PHP interpreter includes and executes the file specified in the parameter. If the attacker can manipulate or target existing local PHP files, or leverage local file inclusion to execute code via predictable locations, arbitrary code execution within the context of the web server process is achieved.\nThe vulnerability requires network exposure accessible to the WordPress application, authenticated access at the Subscriber privilege level, and the existence of local PHP files or inclusion vectors on the target server. The post-exploitation impact includes unauthorized execution of arbitrary code, potential privilege escalation depending on system configurations, and complete compromise of the underlying application integrity."
}