CVE-2026-16263

The CVE concerns the WP Maps WordPress plugin prior to 4.9.7. It lacks a capability check in one of its AJAX actions and fails to validate a user-controlled path before using it in a file inclusion, enabling users with a Subscriber account to include and execute arbitrary existing local PHP files...