The vulnerability allows an authenticated user with subscriber‑level privileges to supply a crafted "page" parameter that forces the plugin to include arbitrary files on the server. Because the included files can be PHP scripts, an attacker who can also upload such files can trigger remote code execution or bypass access controls. The weakness is a classic Local File Inclusion flaw (CWE‑98). The impact is the compromise of server integrity and confidentiality for that user, potentially escalating to full system compromise if the attacker gains administrative access. This flaw does not allow unauthenticated attackers to influence the inclusion directly, but it widens the attack surface for any user who has already gained moderator or subscriber access.

The flaw affects the WP Maps plugin from flippercode, any release version 4.9.8 or older. Users of the Google Maps, OpenStreetMap, Mapbox, Store Locator, Listing, Directory & Filters variant of the plugin should verify the version they are running; any deployment with 4.9.8 or earlier remains vulnerable.

With a CVSS score of 7.5, the vulnerability is considered high severity. The EPSS score is not reported, so current exploitation probability is unknown, yet the flaw is present in widely deployed WordPress sites where subscriber accounts exist. The attacker must be able to upload or otherwise provide a PHP file that can be referenced by the "page" parameter; once the inclusion occurs, arbitrary code execution follows. Because the flaw is not listed in CISA’s KEV catalog, there are no known mass‑mode attacks, but the local nature and the available exploit path keep the risk of targeted exploitation significant.