PT-2026-8389 · WordPress · Wp Maps – Store Locator

Michael Mazzolini · Published 2026-02-16 · Updated 2026-02-17 · CVE-2025-12062

Positive Technologies · (AI Summary)

CVSS v3.1

8.8

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions WP Maps – Store Locator, Google Maps, OpenStreetMap, Mapbox, Listing, Directory & Filters plugin for WordPress versions prior to 4.8.7

Description The WP Maps plugin for WordPress is susceptible to a Local File Inclusion issue. This allows authenticated attackers with Subscriber-level access or higher to include and execute arbitrary .html files on the server. Successful exploitation could lead to bypassing access controls, obtaining sensitive data, or achieving code execution if .html files containing PHP code can be uploaded and included. The vulnerable function is

fc load template()

.

Recommendations Update the WP Maps – Store Locator, Google Maps, OpenStreetMap, Mapbox, Listing, Directory & Filters plugin to version 4.8.7 or later.

Fix

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2025-12062

Affected Products

Wp Maps – Store Locator

References · 9

• https://nvd.nist.gov/vuln/detail/CVE-2025-12062 · Security Note
• https://twitter.com/VulmonFeeds/status/2023554661077131741 · Twitter Post
• https://t.me/cveNotify/152137 · Telegram Post
• https://wordfence.com/threat-intel/vulnerabilities/id/815e5b86-2d1b-4794-b761-dad770393d3e?source=cve · Note
• https://twitter.com/CVEnew/status/2023546423778963866 · Twitter Post
• https://twitter.com/CVEarity/status/2023636033460666401 · Twitter Post
• https://plugins.trac.wordpress.org/changeset/3405282 · Note
• https://twitter.com/TheHackerWire/status/2023552674495672655 · Twitter Post
• https://twitter.com/transilienceai/status/2023601056391835907 · Twitter Post