The WP Maps WordPress plugin before 4.9.3 does not properly sanitize a parameter before using it in a file path, allowing authenticated users to perform Local File Inclusion attacks.
Metrics
Affected Vendors & Products
| Vendors | Products |
|---|---|
| Wordpress |
|
| Wp Maps |
|
No data.
No data.
References
History
Mon, 18 May 2026 11:15:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| First Time appeared |
Wordpress
Wordpress wordpress Wp Maps Wp Maps wp Maps |
|
| Vendors & Products |
Wordpress
Wordpress wordpress Wp Maps Wp Maps wp Maps |
Mon, 18 May 2026 07:45:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Weaknesses | CWE-20 CWE-22 |
Mon, 18 May 2026 06:30:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Description | The WP Maps WordPress plugin before 4.9.3 does not properly sanitize a parameter before using it in a file path, allowing authenticated users to perform Local File Inclusion attacks. | |
| Title | WP Maps < 4.9.3 - Subscriber+ Local File Inclusion | |
| References |
|
MITRE
Status: PUBLISHED
Assigner: WPScan
Published: 2026-05-18T06:00:08.784Z
Updated: 2026-05-18T06:00:08.784Z
Reserved: 2026-04-15T17:43:49.889Z
Link: CVE-2026-6381
Vulnrichment
No data.
NVD
Status : Received
Published: 2026-05-18T07:16:12.710
Modified: 2026-05-18T07:16:12.710
Link: CVE-2026-6381
Redhat
No data.