The WP MAPS PRO plugin fails to verify user capability in an AJAX call that is exposed to unauthenticated users. Because the plugin does not validate a user‑controlled file path before including the file, an attacker can request the AJAX action with any local PHP file on the server. The server will then include and execute that file, giving the attacker arbitrary code execution on the WordPress host. This flaw is a classic example of unsafe file inclusion, mapped to CWE‑666 and CWE‑284.

Instances of WP MAPS PRO installed on WordPress sites where the plugin version is older than 6.1.3 are vulnerable. The plugin is distributed by an unknown vendor; the flaw exists in all installations of that plugin regardless of site role or configuration, as long as the vulnerable versions are active.

Because the vulnerable AJAX endpoint is accessible without authentication and the inclusion path is not sanitized, an attacker only needs the ability to formulate a URL against the site. The EPSS score is not available and the vulnerability is not listed in CISA KEV. The risk is driven by the high impact (code execution) and the low barrier to exploitation. The CVSS score is not supplied, but the lack of checks means the flaw provides a direct path to control the server once the user has any web access. Sites should evaluate their exposure immediately.