CVE-2026-18465: WP MAPS PRO Auth Bypass Vulnerability

CVE-2026-18465 Overview

CVE-2026-18465 is a Local File Inclusion (LFI) vulnerability in the WP MAPS PRO WordPress plugin versions before 6.1.3. The plugin exposes an AJAX action that lacks a capability check and is reachable by unauthenticated users. The handler also fails to validate a user-controlled path before using it in a PHP file inclusion. Unauthenticated attackers can include and execute arbitrary existing local PHP files on the server. The flaw is categorized under [CWE-22] (Improper Limitation of a Pathname to a Restricted Directory).

Critical Impact
Unauthenticated remote attackers can force inclusion of arbitrary local PHP files, enabling execution of server-side code paths outside the plugin's intended scope.

Affected Products

WP MAPS PRO WordPress plugin versions prior to 6.1.3
WordPress sites with the vulnerable plugin activated
Any hosting environment exposing the plugin's AJAX endpoint to unauthenticated visitors

Discovery Timeline

2026-08-09 - CVE-2026-18465 published to NVD
2026-08-10 - Last updated in NVD database

Technical Details for CVE-2026-18465

Vulnerability Analysis

The WP MAPS PRO plugin registers an AJAX action through the WordPress wp_ajax_* and wp_ajax_nopriv_* hooks. Registering the nopriv variant makes the endpoint reachable without authentication. The handler does not call current_user_can() or verify a nonce before processing request parameters. It then reads a user-supplied path parameter and passes it to a PHP include or require construct. Because the plugin does not normalize the path, restrict it to an allowlist, or confine it to the plugin directory, an attacker can traverse the filesystem and include arbitrary .php files that already exist on the server.

Root Cause

The root cause is a missing authorization check combined with unsanitized path handling. Two defects compound each other: the AJAX action is exposed via wp_ajax_nopriv_, and the file inclusion sink consumes attacker-controlled input without validation. Neither capability enforcement nor path canonicalization is applied, matching the [CWE-22] path traversal pattern in a file inclusion context.

Attack Vector

Exploitation occurs over the network against wp-admin/admin-ajax.php. An unauthenticated attacker sends a crafted POST or GET request specifying the vulnerable action parameter and a traversal path such as ../../../wp-config.php variants that resolve to existing PHP files. The included file is executed in the WordPress process context. Impact depends on which PHP files are reachable, including plugin, theme, or uploaded PHP files. When combined with a separate file upload vector, this becomes a route to remote code execution.

No verified proof-of-concept code is published in the referenced advisory. See the WPScan Vulnerability Report for additional technical detail.

Detection Methods for CVE-2026-18465

Indicators of Compromise

Requests to /wp-admin/admin-ajax.php from unauthenticated sources containing path traversal sequences such as ../ or URL-encoded equivalents (%2e%2e%2f) in POST or GET parameters.
AJAX requests referencing WP MAPS PRO action names that originate from clients without a valid WordPress session cookie.
Web server access logs showing repeated admin-ajax.php requests with parameter values pointing to system paths or .php files outside the plugin directory.

Detection Strategies

Inspect WordPress access logs for admin-ajax.php requests with action parameters mapped to the WP MAPS PRO plugin and path-like values in other parameters.
Enable WordPress debug logging or a file integrity monitor to record unusual include/require calls originating from the plugin.
Deploy web application firewall rules that flag path traversal patterns in AJAX POST bodies.

Monitoring Recommendations

Monitor outbound child processes from the php-fpm or web server user that deviate from baseline plugin behavior.
Alert on new or modified PHP files in wp-content/uploads/ that could be pivoted through the inclusion primitive.
Track HTTP 200 responses to admin-ajax.php with unusually large payloads that may indicate file contents returned to the attacker.

How to Mitigate CVE-2026-18465

Immediate Actions Required

Update WP MAPS PRO to version 6.1.3 or later on all WordPress installations.
Audit wp-content/uploads/ and other writable directories for unexpected .php files that could serve as inclusion targets.
Review web server access logs for prior exploitation attempts against admin-ajax.php referencing the plugin's action names.

Patch Information

The vendor addressed the issue in WP MAPS PRO version 6.1.3. The fix introduces a capability check on the affected AJAX action and validates the path parameter before it reaches the file inclusion sink. Consult the WPScan Vulnerability Report for advisory details.

Workarounds

Deactivate WP MAPS PRO until the site can be updated to 6.1.3 or later.
Restrict access to /wp-admin/admin-ajax.php for unauthenticated users at the web application firewall where feasible, allowing only known-good action names.
Configure PHP open_basedir to constrain file inclusion to the WordPress installation directory, reducing the reachable file surface.

bash

# Example WAF rule concept: block traversal sequences in admin-ajax.php requests
# ModSecurity-style pseudo-rule
SecRule REQUEST_URI "@contains /wp-admin/admin-ajax.php" \
  "chain,deny,status:403,id:1026184650,msg:'WP MAPS PRO LFI attempt (CVE-2026-18465)'"
SecRule ARGS "@rx (\.\./|%2e%2e%2f|%2e%2e/)" "t:lowercase"