A path traversal vulnerability in the WP Maps WordPress plugin allows authenticated attackers to potentially access or modify sensitive files on the underlying server.

This vulnerability (CWE-22) involves improper limitation of a pathname to a restricted directory. It requires an authenticated user with low privileges to trigger, potentially allowing the attacker to bypass directory restrictions.

A path traversal vulnerability can allow an attacker to read sensitive configuration files or overwrite critical system files, potentially leading to full site compromise or Remote Code Execution (RCE). Given the CVSS score of 7.5, this poses a substantial risk to the confidentiality and integrity of the hosting environment.

Immediate Action: Update the "WP Maps – Google Maps, OpenStreetMap, Mapbox, Store Locator, Listing, Directory & Filters" plugin to version 4.9.3 or later.

Proactive Monitoring: Inspect server file access logs for directory traversal attempts (e.g., sequences like "../") targeting the plugin's file handling functions.

Compensating Controls: Ensure the web server process runs with the least privilege necessary, limiting the impact if a path traversal vulnerability is successfully exploited.

Public Exploit Available: Unknown

Administrators must update the WP Maps plugin to version 4.9.3 immediately. While the vulnerability requires authentication, the potential for sensitive file access makes it a high-priority update for any WordPress environment using this plugin.