The WP Maps plugin for WordPress contains a Local File Inclusion vulnerability (CWE-22) in the fc_load_template function present in all versions up to 4.8.6. Authenticated users with at least Subscriber privileges can exploit this flaw to include arbitrary .html files on the server. Since these .html files can contain executable PHP code, attackers may achieve code execution, bypass access controls, or access sensitive data. The vulnerability is network exploitable with low attack complexity and does not require user interaction. The CVSS score of 8.8 reflects the critical nature of the impact on confidentiality, integrity, and availability.

Successful exploitation allows attackers with Subscriber-level access or higher to execute arbitrary code on the server by including malicious .html files. This can lead to unauthorized access to sensitive data, bypassing of access controls, and full compromise of the affected WordPress site. The vulnerability affects the confidentiality, integrity, and availability of the system.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict Subscriber-level users from uploading or including files that could be exploited. Monitor for updates from the plugin vendor or WordPress security channels and apply patches promptly once available.