WordPress · Wp Amaps · CVE-2026-6381
**Name of the Vulnerable Software and Affected Versions**
WP Maps versions prior to 4.9.3
**Description**
The WP Maps WordPress plugin fails to properly sanitize a parameter used in a file path. This allows authenticated users to perform Local File Inclusion (LFI), a technique where an attacker includes files on the server through the web application to read sensitive data.
**Recommendations**
Update to version 4.9.3 or later.