The WP MAPS PRO plugin for WordPress prior to version 6.1.3 contains a CWE-22 path traversal vulnerability. Specifically, one of its AJAX actions does not enforce capability checks and is accessible without authentication. Additionally, it fails to properly validate user-controlled input used in file inclusion operations. This combination permits unauthenticated attackers to include and execute arbitrary local PHP files on the affected server, potentially leading to limited confidentiality and integrity impacts.

An unauthenticated attacker can exploit this vulnerability to include and execute arbitrary existing local PHP files on the server. This may lead to limited confidentiality and integrity impacts, such as unauthorized information disclosure or code execution within the constraints of existing files. There is no indication of availability impact. The CVSS score is 6.5 (medium severity).

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vulnerability affects versions before 6.1.3, upgrading to version 6.1.3 or later is recommended once official fixes are available. Until then, restrict access to the vulnerable AJAX action if possible or apply other temporary mitigations as advised by the vendor.