This vulnerability allows authenticated users to include arbitrary files via a parameter that is not properly sanitized before being used in a file path. The lack of input validation means a malicious user could read sensitive files from the server, potentially exposing configuration data, passwords, or other confidential information. The weakness is a classic insecure file inclusion flaw that compromises information confidentiality, but does not directly enable code execution.

The affected software is the WP Maps WordPress plugin for all versions before 4.9.3. The vendor is WP Maps. Users who have an authenticated account with Subscriber+ privileges are able to trigger the vulnerability. No specific sub‑versions are listed; any install of WP Maps earlier than 4.9.3 is potentially vulnerable.

Because the flaw is limited to authenticated users, an attacker must first obtain valid credentials on the WordPress site. No public exploit information or KEV listing is available, and EPSS data is not provided, so the current exploitation probability is uncertain but likely low. The attack vector is inferred to be a local file inclusion request sent by an authenticated user; an attacker could construct requests that include a path traversal payload to read files from the server. If the site hosts sensitive files outside the web root, they could be exposed.