CVE-2026-16263
HighCVSS 8.8Exploitation Probability (EPSS)
Low risk25th percentile - higher than 25% of all known CVEs
Summary
The WP Maps WordPress plugin before 4.9.7 does not perform a capability check in one of its AJAX actions and does not properly validate a user-controlled path before using it in a file inclusion, allowing users with a Subscriber account to include and execute arbitrary existing local PHP files on the server.
Risk Assessment
The risk includes the ability for a low-privileged user to execute arbitrary existing PHP files on the server, potentially leading to server compromise or exposure of sensitive data.
Recommendation
Update the WP Maps plugin to version 4.9.7 or later. Also, validate all file paths thoroughly and restrict access to the AJAX action.
Other vulnerabilities in WP Maps
See all- CVE-2026-39492Critical
There is an unauthenticated SQL injection vulnerability in WP Maps versions up to 4.9.1.
- CVE-2026-18466Medium
The WP Maps WordPress plugin before 4.9.8 does not perform a capability check nor validate a nonce in one of its AJAX actions, allowing users with a Subscriber account to create an unlimited number of options in the database, each loaded on every page request.
- CVE-2026-16265Medium
The WP Maps WordPress plugin before 4.9.7 does not perform a capability check in one of its AJAX actions and does not restrict the operation it dispatches, allowing users with a Subscriber account to trigger uncontrolled recursion that exhausts server resources, resulting in a Denial of Service.
- CVE-2026-28144Medium
The WP Maps plugin for WordPress (versions up to and including 4.9.6) has an insertion of sensitive information into sent data vulnerability. It allows retrieving embedded sensitive data.
- CVE-2026-9594Medium
The WP Maps plugin for WordPress up to version 4.9.4 contains a Stored XSS vulnerability via the 'location_messages' parameter. Attackers with administrator privileges (or lower if granted) can inject scripts that execute when users access the page.
Original NVD description (English source)
The WP Maps WordPress plugin before 4.9.7 does not perform a capability check in one of its AJAX actions and does not properly validate a user-controlled path before using it in a file inclusion, allowing users with a Subscriber account to include and execute arbitrary existing local PHP files on the server.