HIGHVulnerability
Verified
Global

NVD HIGH: CVE-2026-13456 — The WP Maps – Google Maps,OpenStreetMap,Mapbox,Store Locator,Listing,Directory &...

·Source: NIST NVD

Updated:

Executive Summary

The WP Maps – Google Maps,OpenStreetMap,Mapbox,Store Locator,Listing,Directory & Filters plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 4.9.8 via the 'page' parameter parameter. This makes it possible for authenticated attackers, with subscriber-level access and above, to include and execute arbitrary .php files on the server, allowing the executio

Analysis

The WP Maps – Google Maps,OpenStreetMap,Mapbox,Store Locator,Listing,Directory & Filters plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 4.9.8 via the 'page' parameter parameter. This makes it possible for authenticated attackers, with subscriber-level access and above, to include and execute arbitrary .php files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where .php file types can be uploaded and included. CVSS Score: 7.5. Published: 2026-09-25T08:16:39.970.

Indicators of Compromise (1)

CVE (1)
CVE-2026-13456
NVDMITRE CVE
Source Attribution

Originally published by NIST NVD on Sep 25, 2026. Verified by: NIST.

Related Threats

MEDIUMVulnerabilityNEW

Judge dismisses spyware case brought by Salvadoran journalists targeted with Pegasus

The plaintiffs, who all worked for the independent and Salvadoran news outlet El Faro, failed to convince the court that their case had jurisdiction in California, according to the judge’s order.

The Record
MEDIUMVulnerabilityNEW

RemoteThreat Bets Security Teams Need to Test What Happens After Defenses Fail

The offensive cyber operations startup looks to evolve red teaming beyond traditional methods to simulate attackers' increasingly advanced capabilities.

Dark Reading
MEDIUMVulnerability

Bipartisan backlash to ALPRs grows as two high-profile bills are introduced

Republican Sen. Josh Hawley has new legislation on limiting automated license plate readers (ALPRs), while Democratic Sens. Bernie Sanders and Jeff Merkley, with Rep. Alexandria Ocasio-Cortez, have teed up a broader bill.

The Record