CVE-2026-73367: Easy Google Maps RCE Vulnerability

CVE-2026-73367 Overview

CVE-2026-73367 is an unauthenticated Remote File Inclusion (RFI) vulnerability in the Easy Google Maps WordPress plugin in versions prior to 1.14.2. The flaw is classified under [CWE-829: Inclusion of Functionality from Untrusted Control Sphere]. An unauthenticated attacker can supply a remote resource that the vulnerable plugin loads at runtime, altering application behavior across a trust boundary.

The issue carries a CVSS 3.1 base score of 7.2 with a scope change (S:C), reflecting network-reachable exploitation with no privileges or user interaction. The EPSS score is 0.248% (percentile 16.46) as of 2026-08-21, indicating low current exploitation probability. Site owners running the plugin should update to 1.14.2 or later.

Critical Impact
Unauthenticated attackers can force the plugin to include attacker-controlled remote resources, resulting in confidentiality and integrity impact across a changed security scope.

Affected Products

Easy Google Maps WordPress plugin versions prior to 1.14.2
WordPress installations with the google-maps-easy plugin enabled
Any hosting environment permitting outbound HTTP fetches from PHP

Discovery Timeline

2026-08-18 - CVE-2026-73367 published to NVD
2026-08-20 - Last updated in NVD database

Technical Details for CVE-2026-73367

Vulnerability Analysis

The vulnerability allows an unauthenticated remote attacker to trigger a Remote File Inclusion condition in the Easy Google Maps plugin. RFI occurs when an application incorporates an externally referenced file or resource into its execution flow without validating the source. The flaw is reachable across the network with low attack complexity and requires no authentication or user interaction.

Exploitation causes a scope change, meaning the impact extends beyond the vulnerable component into other parts of the WordPress environment. Successful exploitation can result in disclosure of sensitive data, modification of plugin-controlled resources, or the loading of attacker-supplied logic that influences plugin behavior. Availability is not directly impacted according to the published CVSS vector.

Refer to the Patchstack Vulnerability Analysis for the technical breakdown.

Root Cause

The root cause is inclusion of functionality from an untrusted control sphere [CWE-829]. The plugin processes an input value that flows into a file-inclusion or resource-loading operation without restricting the source to trusted locations. Because the parameter accepts remote references, attackers can supply URLs pointing to attacker-controlled infrastructure.

Attack Vector

The attack vector is network-based. An attacker sends a crafted HTTP request to a plugin endpoint exposed by a vulnerable WordPress site. The request includes a parameter that causes the plugin to fetch and process a remote resource. No credentials are required, and the request can be delivered from any internet-connected host that can reach the target site.

No verified public proof-of-concept code is available at the time of publication. Technical details are described in the referenced Patchstack advisory.

Detection Methods for CVE-2026-73367

Indicators of Compromise

Outbound HTTP or HTTPS connections from the PHP worker process to unfamiliar external hosts during plugin request handling
Web access logs containing plugin request parameters holding fully qualified URLs (http://, https://, ftp://) as values
Newly written files under wp-content/uploads/ or plugin directories with unexpected timestamps or PHP content
Modified WordPress admin users or scheduled tasks appearing after plugin requests

Detection Strategies

Inspect HTTP access logs for requests targeting the google-maps-easy plugin containing URL-formatted parameter values
Alert on PHP processes performing outbound network connections during page rendering of plugin routes
Baseline plugin file integrity and alert on unexpected additions or modifications within the plugin directory
Correlate anomalous outbound DNS lookups from web servers with concurrent plugin endpoint requests

Monitoring Recommendations

Enable and centralize WordPress and web server access logs with URL parameter capture
Monitor egress traffic from web server subnets and restrict outbound HTTP fetches originating from PHP
Track plugin version inventory across all WordPress hosts and flag installations below 1.14.2
Review WAF logs for signatures matching remote file inclusion payloads targeting WordPress plugins

How to Mitigate CVE-2026-73367

Immediate Actions Required

Update the Easy Google Maps plugin to version 1.14.2 or later on every affected WordPress instance
Audit web and PHP logs for prior requests containing external URLs in plugin parameters
If patching is not immediately possible, deactivate the google-maps-easy plugin until the update can be applied
Rotate WordPress administrator credentials and API keys if evidence of exploitation is found

Patch Information

The vendor has released version 1.14.2 of the Easy Google Maps plugin, which resolves the remote file inclusion condition. Administrators should install the update through the WordPress plugin management interface or apply it via automated update tooling. See the Patchstack Vulnerability Analysis for advisory details.

Workarounds

Disable the Easy Google Maps plugin until version 1.14.2 or later is installed
Deploy a Web Application Firewall rule that blocks plugin request parameters containing external URL schemes
Set allow_url_include=Off and restrict allow_url_fopen in the PHP configuration to reduce remote inclusion primitives
Restrict outbound network access from the web server to only required destinations at the network layer

bash

# Configuration example: harden php.ini against remote inclusion
allow_url_include = Off
allow_url_fopen = Off