CVE-2026-13456 Overview
The WP Maps WordPress plugin contains a Local File Inclusion (LFI) vulnerability affecting all versions up to and including 4.9.8. The plugin — marketed as WP Maps – Google Maps, OpenStreetMap, Mapbox, Store Locator, Listing, Directory & Filters — fails to properly validate the page parameter before passing it to a file inclusion routine. Authenticated attackers with subscriber-level access or higher can include and execute arbitrary .php files on the server. The flaw is categorized under CWE-98: Improper Control of Filename for Include/Require Statement in PHP Program.
Critical Impact
Authenticated attackers can execute arbitrary PHP code, bypass access controls, and exfiltrate sensitive data from affected WordPress sites.
Affected Products
- WP Maps WordPress plugin versions ≤ 4.9.8
- Deployments previously tracked under the wp-google-map-plugin slug (tags 4.9.3, 4.9.5)
- WordPress sites allowing subscriber-level registration
Discovery Timeline
- 2026-09-25 - CVE-2026-13456 published to NVD
- 2026-09-25 - Last updated in NVD database
Technical Details for CVE-2026-13456
Vulnerability Analysis
The vulnerability resides in the plugin's request handling logic, where the page HTTP parameter is used to resolve a filename passed to a PHP include or require statement. Because the input is not sanitized against directory traversal sequences or constrained to an allowlist, an authenticated user can direct the inclusion routine to any .php file reachable on the server filesystem.
Once included, the target file is executed within the plugin's PHP context. Attackers can leverage this to run arbitrary code if they can place a .php file on disk — for example through other upload paths, log poisoning, or writable session storage. The behavior aligns with [CWE-98] and the plugin source references published on the WordPress plugin trac for tags 4.9.3 and 4.9.5.
Root Cause
The root cause is missing input validation on the page parameter prior to its use in a dynamic file include. The relevant handlers are referenced in class.controller.php line 115 and the main plugin bootstrap at wp-google-map-plugin.php line 605 and line 622. The plugin trusts the page value supplied by the client without canonicalization or allowlist checks.
Attack Vector
Exploitation requires network access to the WordPress admin interface and valid credentials at the subscriber role or higher. The attacker submits a crafted request containing a traversal payload in the page parameter that resolves to a server-side .php file. The included script runs under the web server account, enabling access-control bypass, information disclosure, or full code execution when the attacker can control the contents of an includable .php file.
See the Wordfence vulnerability analysis and the upstream change set for additional technical context.
Stop Remote Code Execution Before It Runs
Singularity™ Endpoint detects and blocks exploit attempts at machine speed, including zero-days and novel attack techniques.
Stop Exploit AttemptsDetection Methods for CVE-2026-13456
Indicators of Compromise
- Requests to WordPress admin endpoints containing traversal sequences such as ../ or encoded variants in the page query parameter.
- Unexpected PHP execution originating from included paths outside the wp-google-map-plugin directory.
- New or modified .php files in wp-content/uploads/ or other writable directories that coincide with authenticated subscriber sessions.
Detection Strategies
- Inspect web server access logs for page= values containing path separators, null-byte markers, or references to files outside the plugin directory.
- Correlate low-privilege WordPress sessions with activity against plugin administrative URLs, which subscribers should not normally trigger.
- Enable PHP open_basedir warnings and monitor for include errors that reveal path traversal attempts.
Monitoring Recommendations
- Alert on creation of .php files in upload directories and on changes to WordPress core or plugin files.
- Track authentication events for subscriber accounts that immediately interact with plugin endpoints.
- Forward WordPress and web server logs to a centralized analytics platform for retention and query against known LFI payload patterns.
How to Mitigate CVE-2026-13456
Immediate Actions Required
- Upgrade the WP Maps plugin to a version released after 4.9.8 that addresses the page parameter handling.
- Audit WordPress user accounts and remove unused subscriber-level registrations, especially on sites with open registration.
- Review web server and PHP logs for prior exploitation attempts referencing the page parameter.
Patch Information
The vendor released a fix tracked in the WordPress plugin repository under change set 3690856. Site operators should update to the latest plugin release available through the WordPress plugin directory and verify the installed version is greater than 4.9.8.
Workarounds
- Disable the WP Maps plugin until the patched version is deployed.
- Restrict new user registration or set the default role to a value that cannot reach plugin admin handlers.
- Place a web application firewall rule to block requests where the page parameter contains ../, ..\, null bytes, or absolute filesystem paths.
# Example WAF rule (ModSecurity) to block traversal in the page parameter
SecRule ARGS:page "@rx (\.\./|\.\.\\|%2e%2e%2f|\\x00)" \
"id:1026013456,phase:2,deny,status:403,msg:'CVE-2026-13456 WP Maps LFI attempt'"
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
