Description

Unauthenticated Remote File Inclusion in Easy Google Maps < 1.14.2 versions.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.2",
  "pubDate": "2026-08-18T15:17:05.123Z",
  "pubdate": "2026-08-18T15:17:05.123Z",
  "executiveSummary": "An unauthenticated Remote File Inclusion (RFI) vulnerability has been identified in Easy Google Maps versions prior to 1.14.2. This security flaw allows remote, unauthenticated attackers to include arbitrary remote or local files via the application, posing severe risks to the underlying server infrastructure. The presence of this vulnerability exposes affected systems to potential remote code execution, sensitive data disclosure, and full application compromise. Attackers do not require prior authentication, valid user credentials, or specific privilege levels to exploit this flaw, making the attack vector highly accessible over the network. Successful exploitation typically requires the target application to misconfigure or inadequately sanitize input parameters utilized in file inclusion mechanisms. Given the critical nature of remote file inclusion flaws, immediate remediation is strongly advised to prevent malicious actors from leveraging the affected software to execute arbitrary commands or access restricted system resources.",
  "technicalDetails": "The vulnerability resides in the input handling and file loading logic of the Easy Google Maps plugin for WordPress, specifically affecting versions strictly below 1.14.2. The root cause stems from improper validation, sanitization, and filtering of user-supplied parameters that are subsequently passed to file inclusion functions within the codebase. Because the application fails to restrict file paths to a safe directory or whitelist permitted files, an unauthenticated remote attacker can manipulate these parameters to point to arbitrary files located externally via network protocols or internally on the local filesystem.\nThe attack flow begins when an external threat actor crafts a specialized HTTP request containing a malicious payload directed at the vulnerable endpoint exposed by Easy Google Maps. Due to the lack of authentication and privilege requirements, the web application processes the request directly without verifying the identity or authorization level of the sender. As the application executes the vulnerable component, it attempts to dynamically include or evaluate the resource specified in the tainted input parameter. If remote URL inclusion is enabled in the underlying PHP configuration, the server will fetch, parse, and execute the remote file supplied by the attacker. In scenarios where remote inclusion is disabled, local file inclusion (LFI) paths or wrapper schemes may still be leveraged to read sensitive configuration files or execute locally stored scripts.\nThe network exposure of this vulnerability is critical, as the affected endpoints are typically accessible over standard HTTP or HTTPS protocols directly from the internet. The payload behavior during successful exploitation can range from arbitrary command execution through web shell deployment to the exfiltration of sensitive configuration data, database credentials, and system files. Post-exploitation impact includes complete system compromise, lateral movement within the network, and persistent unauthorized access to the web server hosting the vulnerable Easy Google Maps instance."
}