Local File Inclusion Vulnerability in WP Maps Plugin

The WP Maps WordPress plugin, specifically versions 4.9.8 and earlier, contains a critical security flaw categorized as Local File Inclusion (LFI). This vulnerability resides in the 'page' parameter and is accessible to any user with subscriber-level permissions or higher. An attacker can manipulate this parameter to point to arbitrary files stored on the server. If the attacker can upload a file containing malicious PHP code or leverage existing files on the host, they can force the server to execute that code. This vulnerability poses a significant risk to the integrity and confidentiality of the host environment, as it allows for bypass of application-level access controls and potential remote code execution. Defenders should prioritize updating to a patched version or auditing plugin usage to restrict access to the affected functionality.

Attack Chain

1. Attacker obtains valid subscriber-level credentials for a WordPress site running the vulnerable plugin.
2. Attacker logs into the WordPress dashboard and navigates to the endpoint utilizing the WP Maps plugin.
3. Attacker crafts a malicious HTTP GET or POST request targeting the parameter 'page'.
4. Attacker injects a path traversal or local file path into the 'page' parameter to target a specific file on the server filesystem.
5. The plugin code fails to validate or sanitize the 'page' parameter input.
6. The PHP include function processes the path, triggering the execution of the targeted .php file.
7. Malicious code within the included file executes with the privileges of the web server user.

Impact

Successful exploitation allows attackers with low-level privileges to gain unauthorized access to sensitive server data, bypass authentication mechanisms, or achieve remote code execution. This can lead to full compromise of the web application and the underlying server environment, depending on the server's configuration and file permissions.

Recommendation

• Update the WP Maps plugin to the latest version immediately to remediate CVE-2026-13456.
• Audit access logs for suspicious HTTP requests containing directory traversal sequences (e.g., ../) within the 'page' parameter.
• Enforce strict input validation on all plugins to prevent arbitrary file path inclusion.
• Monitor for unexpected file uploads to directories that the web server can read or execute.