CVE-2026-13456

Name of the Vulnerable Software and Affected Versions WP Maps – Google Maps,OpenStreetMap,Mapbox,Store Locator,Listing,Directory & Filters versions prior to 4.9.9

Description Local File Inclusion occurs via the page parameter. Authenticated attackers with subscriber-level access or higher can include and execute arbitrary .php files on the server. This allows for the execution of PHP code contained within those files, which can be used to bypass access controls, obtain sensitive data, or achieve remote code execution if .php files can be uploaded to the server.

Recommendations Update the plugin to version 4.9.9 or later. Avoid using the page parameter in the affected plugin until the update is applied.