CVE-2026-13456 in WP Maps Plugin
Summary
by MITRE • 09/25/2026
The WP Maps – Google Maps,OpenStreetMap,Mapbox,Store Locator,Listing,Directory & Filters plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 4.9.8 via the 'page' parameter parameter. This makes it possible for authenticated attackers, with subscriber-level access and above, to include and execute arbitrary .php files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where .php file types can be uploaded and included.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 09/25/2026
The WP Maps plugin for WordPress contains a critical Local File Inclusion vulnerability affecting all versions up through 4.9.8. This security flaw is located within the handling of the page parameter, which fails to properly validate or sanitize user-supplied input before using it in file inclusion operations. The nature of this defect allows an attacker to manipulate the path resolution mechanism on the server side, effectively directing the application to load and execute files from arbitrary locations within the filesystem rather than restricting execution to intended plugin directories. This type of vulnerability is formally classified under CWE-98 Improper Control of Filename for Include/Require Statement in the PHP Language, which highlights the failure to enforce strict constraints on file paths provided by external sources.
The operational impact of this vulnerability is severe due to its potential for remote code execution when combined with specific server configurations or upload capabilities. Although the exploitation requires authentication and a minimum of subscriber-level access rights, these privileges are relatively easy for malicious actors to obtain through credential stuffing, phishing, or exploiting other weak points in WordPress installations. Once authenticated, an attacker can craft requests that include arbitrary PHP files stored on the web server. If the environment allows for file uploads where .php extensions are permitted, such as in certain media library configurations or theme editor contexts, the attacker can upload a malicious script and then trigger its execution via this LFI flaw. This effectively bypasses standard access controls and grants the attacker full control over the PHP interpreter running on the server.
From an offensive security perspective, this vulnerability aligns with several techniques documented in the MITRE ATT&CK framework for enterprise environments. Specifically, it relates to T1504 Weak or Compromised Authentication Credentials, as initial access often relies on compromised accounts. The exploitation phase maps directly to T1059 Command and Scripting Interpreter, particularly PHP execution, allowing the attacker to run arbitrary commands within the context of the web server process. Furthermore, if sensitive data is exfiltrated through this vector, it falls under T1005 Data from Local System. The ability to include files outside the intended directory structure also touches upon path traversal concepts often associated with CWE-22 Improper Limitation of a Pathname to a Restricted Directory, although the primary mechanism here is inclusion rather than just reading static content.
Mitigation strategies must focus on immediate patching and defensive configuration changes. The most effective remediation is to update the WP Maps plugin to version 4.9.9 or later, where the developers have implemented proper input validation and sanitization for the page parameter. Until an upgrade can be performed, administrators should restrict file upload permissions within WordPress media settings to prevent .php files from being stored on the server. Additionally, implementing a Web Application Firewall with rules that detect common LFI patterns in URL parameters can provide a layer of defense against exploitation attempts. Regular security audits and monitoring for unusual PHP execution logs are also recommended to identify any potential compromise resulting from this vulnerability before it leads to full system takeover.