CVE-2025-12062 is a path traversal vulnerability classified under CWE-22 found in the WP Maps – Store Locator, Google Maps, OpenStreetMap, Mapbox, Listing, Directory & Filters plugin for WordPress. The vulnerability exists in the fc_load_template function, which improperly limits the pathname to a restricted directory, allowing an authenticated user with Subscriber-level privileges or higher to include arbitrary .html files from the server. This inclusion can lead to local file inclusion (LFI) attacks. If the attacker can upload .html files containing embedded PHP code, the server may execute this code, resulting in remote code execution (RCE). This flaw enables attackers to bypass access controls, extract sensitive information, and potentially take full control of the affected WordPress site. The vulnerability affects all versions up to 4.8.6, with no patches currently available. The CVSS 3.1 score of 8.8 reflects the high impact on confidentiality, integrity, and availability, with network attack vector, low attack complexity, and only requiring low privileges and no user interaction. Although no known exploits are publicly reported, the vulnerability is critical due to the widespread use of the plugin and WordPress in general.

For European organizations, this vulnerability poses a significant risk, particularly for those relying on WordPress sites with the affected plugin installed. Attackers with minimal privileges can escalate their access to execute arbitrary code, potentially leading to full site compromise, data breaches, defacement, or use of the site as a pivot point for further attacks within the network. This can disrupt business operations, damage reputation, and lead to regulatory non-compliance under GDPR due to unauthorized data access or leakage. Organizations in sectors such as e-commerce, government, education, and media, which commonly use WordPress, are especially vulnerable. The ease of exploitation combined with the potential for severe impact on confidentiality, integrity, and availability makes this a critical threat to European digital infrastructure.

Immediate mitigation steps include restricting file upload capabilities for Subscriber-level users and below, especially blocking .html file uploads or any file types that could contain executable code. Organizations should audit their WordPress installations to identify the presence of the vulnerable plugin and upgrade to a patched version once available. In the absence of a patch, applying virtual patching via Web Application Firewalls (WAFs) to block suspicious requests targeting the fc_load_template function or path traversal patterns is recommended. Additionally, implementing strict file permission policies on the server to prevent execution of uploaded files and monitoring logs for unusual file inclusion attempts can reduce risk. Regularly reviewing user roles and minimizing privileges to the least necessary will also limit exploitation potential. Backup strategies should be enhanced to enable rapid recovery in case of compromise.