The WP Maps WordPress plugin prior to version 4.9.3 contains a CWE-22 path traversal vulnerability due to improper sanitization of a parameter before its use in a file path. Authenticated users can exploit this flaw to perform Local File Inclusion attacks, potentially accessing sensitive files on the hosting server. The vulnerability is documented under CVE-2026-6381. No CVSS score or vendor advisory is available to confirm patch status or detailed impact.

Authenticated users can exploit this vulnerability to include local files on the server, which may lead to unauthorized disclosure of sensitive information or other impacts depending on the included files. There is no evidence of active exploitation in the wild. The impact is limited to users who have authentication access to the vulnerable plugin functionality.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict authenticated user privileges to trusted users only and monitor for suspicious activity related to file inclusion attempts within the WP Maps plugin. Avoid exposing the plugin to untrusted users.