CVE-2026-16263: 
WordPress vulnerability analysis and mitigation

CVE-2026-16263 is a Local File Inclusion (LFI) vulnerability in the WP Maps WordPress plugin (also known as wp-google-map-plugin) that allows authenticated users with Subscriber-level access to include and execute arbitrary existing local PHP files on the server. The vulnerability affects all versions of WP Maps before 4.9.7, developed by WePlugins. It was publicly disclosed on August 3, 2026, and assigned a CVSS v3.1 base score of 8.8 (High) by CISA-ADP (WPScan, Github Advisory).

The root cause is a missing capability check in one of the plugin's AJAX action handlers, combined with improper validation of a user-controlled file path before it is used in a PHP file inclusion operation (CWE-22: Path Traversal). An attacker with a Subscriber account can craft an AJAX request supplying a malicious path parameter that traverses outside the intended directory, causing the server to include and execute an arbitrary existing local PHP file. The vulnerability was discovered and reported by researcher Jakub Herman. A proof-of-concept is scheduled for public release on September 11, 2026, to allow time for users to update (WPScan, Github Advisory).

Successful exploitation grants an attacker with only a Subscriber account the ability to execute arbitrary PHP code on the server, resulting in high impact to confidentiality, integrity, and availability. An attacker could read sensitive files (e.g., wp-config.php containing database credentials), modify site content, install backdoors, or fully compromise the underlying server. This could also serve as a pivot point for lateral movement within the hosting environment (WPScan, Github Advisory).

CISA-ADP has classified the exploitation status as "poc" in its SSVC assessment, indicating a proof-of-concept exists, though WPScan has withheld its publication until September 11, 2026. There is no current evidence of active in-the-wild exploitation. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score is approximately 0.30–0.34%, placing it in the 27th percentile for exploitation likelihood within 30 days. Exploitation requires a low-privilege authenticated account (Subscriber), making it accessible to any registered user on a vulnerable WordPress site (WPScan, Github Advisory).

1. Reconnaissance: Identify WordPress sites running the WP Maps plugin (slug: wp-google-map-plugin) in a version before 4.9.7 using tools like WPScan, Shodan, or by inspecting plugin directories on target sites.
2. Account Registration: Register or obtain a Subscriber-level account on the target WordPress site (or use an existing low-privilege account).
3. Identify the vulnerable AJAX action: Locate the unprotected AJAX action handler in the WP Maps plugin that accepts a user-controlled file path parameter without capability checks.
4. Craft malicious AJAX request: Send an authenticated POST request to wp-admin/admin-ajax.php with the appropriate action parameter and a crafted path value using path traversal sequences (e.g., ../../) to point to a target PHP file on the server (e.g., wp-config.php or a previously uploaded PHP file).
5. Achieve code execution: The server includes and executes the specified PHP file, allowing the attacker to read sensitive configuration data or execute arbitrary PHP code, potentially establishing a web shell or exfiltrating credentials (WPScan).

• Network: Unusual POST requests to wp-admin/admin-ajax.php from Subscriber-level authenticated sessions containing path traversal sequences (../, ..%2F, %2e%2e%2f) in parameters; unexpected outbound connections from the web server process.
• Logs: WordPress or web server access logs showing repeated AJAX requests with suspicious file path parameters targeting PHP files outside the plugin directory; PHP error logs referencing unexpected file inclusion paths.
• File System: Presence of new or modified PHP files in the WordPress installation (e.g., web shells in wp-content/uploads/); unexpected changes to wp-config.php or core files.
• Process: Unusual child processes spawned by the PHP/web server process (e.g., bash, curl, wget) indicating post-exploitation activity.

The vendor (WePlugins) has released WP Maps version 4.9.7, which addresses the missing capability check and improper path validation. All users should upgrade to version 4.9.7 or later immediately. As a temporary workaround if patching is delayed, site administrators should restrict open user registration or remove the Subscriber role from untrusted users, and monitor AJAX requests for suspicious file path parameters. Web application firewalls (WAFs) can be configured to block requests containing path traversal sequences targeting admin-ajax.php (WPScan, Github Advisory).

Wordfence covered this vulnerability in its weekly WordPress vulnerability report for August 3–9, 2026, highlighting it among notable plugin security issues (Wordfence Blog). The vulnerability was also noted on Mastodon by security news accounts shortly after disclosure. INCIBE (Spain's national cybersecurity agency) published an early warning advisory for the vulnerability. Community reaction has been moderate, consistent with a high-severity but authenticated WordPress plugin flaw.