Security Advisory

CVE-2026-18465

CVE vulnerability detail - eXtreme Datacenter Security Operations

Published 2026-08-09 06:00:13

Last updated 2026-08-10 19:28:34

Assigner WPScan

CVSS score 6.5

State PUBLISHED

Description

The WP MAPS PRO WordPress plugin before 6.1.3 does not perform a capability check in one of its AJAX actions, which is also available to unauthenticated users, and does not properly validate a user-controlled path before using it in a file inclusion, allowing unauthenticated attackers to include and execute arbitrary existing local PHP files on the server.

← Browse all CVEs View on cve.org ↗