Description

The WP MAPS PRO WordPress plugin before 6.1.3 does not perform a capability check in one of its AJAX actions, which is also available to unauthenticated users, and does not properly validate a user-controlled path before using it in a file inclusion, allowing unauthenticated attackers to include and execute arbitrary existing local PHP files on the server.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.5",
  "pubDate": "2026-08-09T06:19:05.653Z",
  "pubdate": "2026-08-09T06:19:05.653Z",
  "executiveSummary": "A Local File Inclusion (LFI) vulnerability exists in the WP MAPS PRO WordPress plugin affecting versions prior to 6.1.3.\nThe security flaw arises from an unauthenticated AJAX action that fails to enforce proper capability checks and lacks input validation on a user-controlled path parameter.\nUnauthenticated remote threat actors can exploit this vulnerability to perform arbitrary local PHP file inclusion attacks, leading to potential execution of existing local files on the underlying server.\nThe risk implications are critical, as the exposure of an AJAX endpoint without authentication requirements allows arbitrary system interaction and unauthorized code execution pathways within the WordPress environment.\nExploitation requirements are minimal, requiring network access to the target WordPress installation and the ability to craft malicious requests targeting the vulnerable AJAX endpoint without any prior authentication or privileged access.",
  "technicalDetails": "The root cause of the vulnerability stems from two primary software defects within the WP MAPS PRO plugin: an absent authorization check in a specific AJAX action handler and an insecure implementation of file inclusion logic.\nThe vulnerable component is exposed to unauthenticated users, allowing external HTTP requests to invoke the AJAX action without validating the session context or user capabilities.\nDuring execution, the AJAX action processes a user-controlled parameter representing a file path. The application fails to perform strict sanitization, validation, or white-listing on this parameter prior to passing it into a file inclusion function.\nThe attack flow proceeds as follows: First, the unauthenticated attacker crafts a specialized HTTP request targeting the exposed AJAX endpoint of the WP MAPS PRO plugin. Second, the request injects a manipulated path targeting an existing local PHP file on the server into the vulnerable parameter. Third, because the application omits capability checks and path validation, the server processes the inclusion directive, loading and executing the targeted local file within the PHP execution context.\nAffected versions include all iterations of the WP MAPS PRO WordPress plugin prior to version 6.1.3.\nAuthentication and privilege requirements are entirely absent, meaning unauthenticated network attackers can successfully trigger the vulnerable code path.\nThe network exposure is public-facing, assuming the WordPress instance is accessible via the web, making the AJAX endpoint reachable over standard HTTP/HTTPS protocols.\nThe post-exploitation impact includes unauthorized execution of arbitrary local PHP files residing on the server, potentially exposing sensitive system internals or facilitating further compromise depending on the accessibility and contents of locally stored files."
}