THREATOPS
THREAT OPS › Threat News › [NVD] CVE-2026-18465 — The WP MAPS PRO WordPress plugin before 6.1.3 does not perform a capability check in one of its AJAX actions, which is also available to unauthenticated users, and does not properly validate a user-controlled path before using it in a file inclusion, allowing unauthenticated atta

[NVD] CVE-2026-18465 — The WP MAPS PRO WordPress plugin before 6.1.3 does not perform a capability check in one of its AJAX actions, which is also available to unauthenticated users, and does not properly validate a user-controlled path before using it in a file inclusion, allowing unauthenticated atta

mednvdPublished 2026-08-09

CVE-2026-18465 CVSS: None Published: 2026-08-09T06:19:05.653

The WP MAPS PRO WordPress plugin before 6.1.3 does not perform a capability check in one of its AJAX actions, which is also available to unauthenticated users, and does not properly validate a user-controlled path before using it in a file inclusion, allowing unauthenticated attackers to include and execute arbitrary existing local PHP

Indicators of compromise

Original source: https://nvd.nist.gov/vuln/detail/CVE-2026-18465