Unauthenticated Local File Inclusion in WP Maps WordPress Plugin

Executive Summary

This vulnerability is a Local File Inclusion (LFI) issue in the WP Maps WordPress plugin versions before 4.9.7. It occurs because the plugin fails to check user permissions in an AJAX action and does not validate a user-controlled path before including it in a file operation. This allows Subscriber-level users to include and execute arbitrary local PHP files on the server.

Useful 0 Not Useful 0

Detection Guidance

Check if the WP Maps plugin version is below 4.9.7 by inspecting the WordPress admin panel or using commands like 'wp plugin list' in WP-CLI. Look for suspicious AJAX requests or file inclusion attempts in server logs.

Useful 0 Not Useful 0

Impact Analysis

An attacker with a Subscriber account could exploit this to execute malicious PHP files on your server, potentially leading to unauthorized access, data theft, or further compromise of your WordPress site and server.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to unauthorized data access or exfiltration, violating GDPR's data protection requirements and HIPAA's security rules for protected health information. Non-compliance may result in legal penalties and reputational damage.

Useful 0 Not Useful 0

Mitigation Strategies

Update the WP Maps plugin to version 4.9.7 or later immediately. If updating is not possible, consider disabling the plugin temporarily until an update is applied.

Useful 0 Not Useful 0