This vulnerability (CVE-2026-73367) affects Easy Google Maps versions before 1.14.2 and involves unauthenticated remote file inclusion. The root cause is the inclusion of functionality from an untrusted control sphere, classified under CWE-829. The CVSS 3.1 score is 7.2 (high), with attack vector network, low attack complexity, no privileges or user interaction required, and scope changed. The impact includes low confidentiality and integrity impacts but no availability impact. No known exploits in the wild or vendor patches have been reported yet.

An attacker can remotely include files without authentication, potentially leading to partial disclosure or modification of data (confidentiality and integrity impacts). There is no impact on system availability. The scope is changed, indicating the vulnerability affects components beyond the initially vulnerable component.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict access to the affected plugin and monitor for suspicious activity related to remote file inclusion attempts.