CVE-2026-6381: WP Maps Path Traversal Vulnerability

CVE-2026-6381 Overview

CVE-2026-6381 is a Local File Inclusion (LFI) vulnerability in the WP Maps WordPress plugin in versions prior to 4.9.3. The plugin fails to properly sanitize a user-supplied parameter before using it in a file path. Authenticated users can leverage this flaw to include arbitrary local files on the server.

The vulnerability is tracked under [CWE-22] (Improper Limitation of a Pathname to a Restricted Directory). Successful exploitation can expose sensitive files such as wp-config.php, application source code, and credentials stored on the filesystem.

Critical Impact

Authenticated attackers can read sensitive server-side files and potentially achieve code execution by including attacker-controlled content through the WP Maps plugin parameter.

Affected Products

• WP Maps WordPress plugin versions prior to 4.9.3
• WordPress sites with WP Maps installed and active
• Sites permitting authenticated user roles with access to plugin functionality

Discovery Timeline

• 2026-05-18 - CVE-2026-6381 published to NVD
• 2026-05-18 - Last updated in NVD database

Technical Details for CVE-2026-6381

Vulnerability Analysis

The WP Maps plugin accepts a parameter that influences a file path used by server-side code. The plugin does not validate or sanitize this parameter against directory traversal sequences such as ../ or absolute path references. Attackers authenticated to the WordPress instance can manipulate the parameter to traverse out of the intended directory.

An attacker can request arbitrary files readable by the web server process. Common targets include wp-config.php, which stores database credentials and authentication keys. The flaw is classified as Local File Inclusion because the included file is read or executed within the PHP runtime context.

The attack requires network access and valid plugin-accessible credentials. Attack complexity is elevated because the attacker must locate the vulnerable parameter and craft a path that resolves to a target file on the host.

Root Cause

The root cause is missing input sanitization on a parameter passed into a file inclusion or file read operation. The plugin concatenates user input directly into a filesystem path without restricting characters or enforcing a base directory. This is a textbook instance of [CWE-22] path traversal leading to file inclusion.

Attack Vector

The vector is network-based and requires authentication. An authenticated user submits a crafted request to a WP Maps endpoint, supplying a traversal payload in the vulnerable parameter. The plugin resolves the path and reads the targeted file, returning its contents or executing it as PHP if the target is a PHP source file.

See the WPScan Vulnerability Report for technical details.

Detection Methods for CVE-2026-6381

Indicators of Compromise

• HTTP requests to WP Maps plugin endpoints containing path traversal sequences such as ../, ..%2f, or URL-encoded variants
• Web server access logs showing unusual file reads originating from PHP processes invoked by the plugin
• Outbound or response traffic disclosing contents of wp-config.php or other sensitive server files
• Unexpected authenticated POST or GET requests from low-privilege accounts to plugin file-handling functions

Detection Strategies

• Inspect WordPress access logs for query strings or POST parameters containing directory traversal patterns directed at WP Maps endpoints
• Deploy web application firewall (WAF) rules that flag path traversal payloads on authenticated WordPress routes
• Correlate authenticated session activity with anomalous filesystem access patterns on the PHP-FPM or web server worker

Monitoring Recommendations

• Enable verbose request logging for /wp-admin/admin-ajax.php and any WP Maps shortcode handlers
• Alert on responses containing markers such as DB_PASSWORD, AUTH_KEY, or PHP open tags returned through plugin endpoints
• Monitor low-privilege WordPress accounts for sudden activity against plugin administration functions

How to Mitigate CVE-2026-6381

Immediate Actions Required

• Upgrade the WP Maps plugin to version 4.9.3 or later on all WordPress instances
• Audit WordPress user accounts and revoke unnecessary authenticated access to plugin functionality
• Review web server and PHP error logs for prior exploitation attempts against WP Maps endpoints
• Rotate WordPress secrets in wp-config.php if file disclosure is suspected

Patch Information

The vendor addressed the vulnerability in WP Maps version 4.9.3. Site administrators should update through the WordPress plugin manager or by deploying the patched plugin package. Refer to the WPScan Vulnerability Report for advisory details.

Workarounds

• Temporarily deactivate the WP Maps plugin until the upgrade to 4.9.3 is applied
• Restrict access to WordPress authentication using IP allowlists or multi-factor authentication to limit the pool of authenticated attackers
• Configure a WAF rule to block path traversal patterns (../, ..%2f, ..%5c) in requests targeting WP Maps endpoints
• Apply open_basedir restrictions in PHP to confine file reads to the WordPress installation directory