CVE-2026-18465: 
WordPress vulnerability analysis and mitigation

CVE-2026-18465 is an unauthenticated Local File Inclusion (LFI) vulnerability in the WP MAPS PRO WordPress plugin (also known as wp-google-map-gold) affecting all versions before 6.1.3. The flaw allows unauthenticated attackers to include and execute arbitrary existing local PHP files on the server by exploiting an unprotected AJAX action with improper path validation. It was publicly disclosed on August 3, 2026, and assigned a CVSS score of 8.6 (High) (WPScan, GitHub Advisory). The vulnerability was discovered and reported by researcher Jakub Herman (WPScan).

The root cause is a missing capability check on an AJAX action that is accessible to unauthenticated users, combined with improper validation of a user-controlled file path before it is passed to a PHP file inclusion function (CWE-22: Improper Limitation of a Pathname to a Restricted Directory / Path Traversal). An unauthenticated attacker can craft a request to the vulnerable AJAX endpoint, supplying a manipulated path parameter that references an existing PHP file on the server, which is then included and executed by the application. No authentication or elevated privileges are required to trigger the vulnerability. A proof-of-concept is scheduled for public release on September 11, 2026, to allow time for users to update (WPScan).

Successful exploitation allows an unauthenticated remote attacker to include and execute arbitrary existing PHP files on the server, effectively achieving remote code execution in the context of the web server process. This can lead to full compromise of the WordPress site, unauthorized access to sensitive data (including database credentials stored in wp-config.php), and potential lateral movement within the hosting environment. The impact is classified under OWASP Top 10 A1: Injection, and the attack requires no user interaction or prior authentication (WPScan, GitHub Advisory).

As of the disclosure date, there is no public proof-of-concept exploit available, and no evidence of active in-the-wild exploitation has been reported. WPScan has indicated the PoC will be published on September 11, 2026. The EPSS score is currently 0.0, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The attack is network-accessible and requires no authentication, making it a high-priority patching target despite the current lack of active exploitation (WPScan, GitHub Advisory).

1. Reconnaissance: Identify WordPress sites running the WP MAPS PRO (wp-google-map-gold) plugin in a version prior to 6.1.3 using tools like WPScan, Shodan, or by inspecting plugin directories via publicly accessible paths.
2. Identify the vulnerable AJAX endpoint: Locate the unprotected AJAX action registered by the plugin that is accessible to unauthenticated users (typically via wp-admin/admin-ajax.php with a specific action parameter).
3. Craft a malicious request: Send an HTTP POST request to wp-admin/admin-ajax.php with the vulnerable action parameter and a user-controlled path parameter pointing to a target PHP file on the server (e.g., wp-config.php or a previously uploaded file).
4. Trigger file inclusion: The server-side code, lacking proper path validation, includes and executes the specified PHP file, resulting in code execution or disclosure of sensitive file contents.
5. Achieve objective: Depending on the included file, the attacker may extract database credentials, execute arbitrary commands, or escalate access within the hosting environment (WPScan).

• Network: Unusual POST requests to wp-admin/admin-ajax.php from unauthenticated sources containing path traversal sequences (e.g., ../, ..%2F) or references to sensitive files like wp-config.php in request parameters.
• Logs: Web server access logs showing repeated or anomalous requests to admin-ajax.php with unexpected action parameter values associated with the WP MAPS PRO plugin; PHP error logs indicating file inclusion of unexpected paths.
• File System: Presence of newly created PHP web shells or unexpected files in the WordPress upload directory or plugin directories.
• Process: Unusual child processes spawned by the web server process (e.g., bash, curl, wget) following requests to admin-ajax.php.

The vendor has released version 6.1.3 of the WP MAPS PRO plugin, which addresses this vulnerability by implementing proper capability checks and path validation. Site administrators should update the plugin to version 6.1.3 or later immediately. If an immediate update is not possible, the plugin should be deactivated or removed until patching can be performed. Additionally, deploying a Web Application Firewall (WAF) with rules targeting path traversal patterns in AJAX requests can provide interim protection (WPScan, GitHub Advisory).