The WP Maps plugin contains a local file inclusion flaw in its fc_load_template function. Authenticated users with Subscriber privileges or higher can supply a path to an arbitrary .html file that the server will include. Because .html files may contain PHP code, the attacker can execute arbitrary PHP, effectively enabling remote code execution and the ability to bypass access controls and access sensitive data.

All installations of the WP Maps – Store Locator, Google Maps, OpenStreetMap, Mapbox, Listing, Directory & Filters plugin for WordPress up to and including version 4.8.6 are affected. The plugin is maintained by flippercode. Upgrading to any version newer than 4.8.6 removes this vulnerability.

The CVSS score of 8.8 indicates high severity. The EPSS score is less than 1 %, suggesting low observed exploitation probability at this moment, and the vulnerability is not listed in CISA’s KEV catalog. The attack requires an authenticated account with Subscriber privileges or higher and the ability to upload or otherwise place an executable .html file on the server. Once such a file exists, the attacker can trigger fc_load_template to include the file, leading to code execution. The limited local file inclusion nature means the vulnerability is not exploitable remotely by unauthenticated users.