The WP Maps plugin before version 4.9.7 fails to perform a capability check on one of its AJAX actions and does not properly validate a user‑controlled path parameter before including it. This flaw allows a user with a Subscriber role to reference any local PHP file on the web server, resulting in the execution of that file and effectively giving the attacker remote code execution capabilities on the host. The weakness originates from missing input validation and inadequate access control.

The vulnerability affects the WP Maps WordPress plugin, any installation using a version earlier than 4.9.7. Only users with a Subscriber designation can trigger the vulnerable AJAX action, but once triggered they can include arbitrary files that exist on the server’s file system.

The EPSS score is < 1% and the CVSS score is 8.8, indicating a high severity. The attack vector is a web‑based XMLHttpRequest to the plugin’s AJAX endpoint, requiring only a valid Subscriber account which is typically granted to normal website users. Because the required input is user‑controlled and no additional privileges are needed, the likelihood of exploitation is significant for sites that have not upgraded their plugin. The risk is compounded by the widespread use of WP Maps in WordPress installations worldwide.