The WP Maps plugin for WordPress versions prior to 4.9.7 contains a path traversal vulnerability (CWE-22) due to missing capability checks and improper validation of user-supplied paths in an AJAX action. This flaw enables low-privileged users (Subscribers) to include and execute arbitrary local PHP files on the server, which can lead to remote code execution. The vulnerability has a CVSS 3.1 base score of 8.8, indicating high severity with network attack vector, low attack complexity, and no user interaction required.

An attacker with a Subscriber account can exploit this vulnerability to include and execute arbitrary local PHP files on the server. This can lead to full compromise of the affected WordPress site, including confidentiality, integrity, and availability impacts. The vulnerability allows remote code execution with high impact on confidentiality, integrity, and availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict Subscriber account capabilities and monitor for suspicious activity related to the plugin's AJAX actions. Avoid using the vulnerable plugin version in production environments.