CVE-2026-18465

The CVE refers to the WP MAPS PRO WordPress plugin (pre-6.1.3) where an AJAX action, reachable without authentication, lacks a capability check and improperly validates a user-controlled path before a file inclusion. This enables unauthenticated attackers to include and execute arbitrary existing...