What the vulnerability does
01Description
The WP Maps – Store Locator,Google Maps,OpenStreetMap,Mapbox,Listing,Directory & Filters plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 4.8.6 via the fc_load_template function. This makes it possible for authenticated attackers, with Subscriber-level access and above, to include and execute arbitrary .html files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where .html file types can be uploaded and included.
Explanation of Vulnerability in Simple Terms
02Summary
WP Maps – Store Locator allows authenticated users to read, modify, or delete arbitrary files on the server through path traversal. An attacker with low-level site access can navigate outside intended directories to access sensitive files like configuration files, database backups, or other users' data. This affects all versions up to 4.8.6.
What an attacker can do
03Attacker Capabilities
Read, modify, or delete any file on the server that the web server process can access.
Potential impact on your site
04Site Impact
Sensitive files (wp-config.php, database backups, private user data) can be exposed, altered, or destroyed by any authenticated user.
Conditions required to exploit
05Prerequisites
Attacker must have a low-privilege user account on the site (subscriber, contributor, or equivalent).
Key dates
06Disclosure timeline
February 16, 2026
CVE published
April 8, 2026
Record updated
