WordPress Plugin Vulnerabilities

WP Maps Pro < 6.1.3 - Unauthenticated Local File Inclusion

Description

The plugin does not perform a capability check in one of its AJAX actions, which is also available to unauthenticated users, and does not properly validate a user-controlled path before using it in a file inclusion, allowing unauthenticated attackers to include and execute arbitrary existing local PHP files on the server.

Proof of Concept

Affects Plugins

Plugin icon
wp-google-map-gold
Fixed in 6.1.3

References

CVE
CVE-2026-18465

Classification

Type
LFI
OWASP top 10
A1: Injection
CWE
CWE-22
CVSS
8.6 (high)

Miscellaneous

Original Researcher
Jakub Herman
Submitter
Jakub Herman
Submitter website
https://www.jakubherman.net
Verified
Yes
WPVDB ID
53da3a6d-1eab-4f61-ba61-fa7a04d2205a

Timeline

Publicly Published
2026-08-03 (about 27 days ago)
Added
2026-08-03 (about 26 days ago)
Last Updated
2026-08-27 (about 2 days ago)

Other

Published
Title
Published
2025-08-15
Title
WPGYM - Wordpress Gym Management System <= 67.7.0 - Authenticated (Subscriber+) Local File Inclusion to Privilege Escalation via Password Update
Published
2025-04-09
Title
WP-BusinessDirectory < 3.1.3 - Unauthenticated Arbitrary File Deletion
Published
2025-09-24
Title
BlindMatrix e-Commerce < 3.1 - Contributor+ LFI
Published
2025-08-28
Title
Slider Revolution < 6.7.37 - Authenticated (Contributor+) Arbitrary File Read via 'used_svg' and 'used_images'
Published
2026-01-16
Title
Feeds for YouTube Pro < 2.6.1 - Unauthenticated Arbitrary File Read via Path Traversal