CVE-2026-16263

Executive Summary

CVE-2026-16263 is a critical arbitrary local file inclusion (LFI) vulnerability in the WP Maps WordPress plugin prior to version 4.9.7. The flaw combines a missing capability check in an AJAX action with insufficient validation of a user-controlled file path, allowing any authenticated user with a Subscriber-role account to include and execute arbitrary existing local PHP files on the server. Successful exploitation can lead to remote code execution, privilege escalation, and full site compromise. All WordPress installations running WP Maps versions below 4.9.7 are affected, and patch deployment is strongly recommended.

Technical Analysis

The vulnerability resides in an AJAX action handler within the WP Maps plugin. The affected functionality fails to verify whether the authenticated user has the required permissions (capability check) before processing the request. WordPress AJAX actions registered with wp_ajax_ (and critically, wp_ajax_nopriv_) hooks allow low-privileged users to invoke them; in this case, a Subscriber-level account is sufficient.

The second component of the flaw is a path traversal/local file inclusion vector. The plugin takes a user-controlled parameter — likely a filename or template path — and uses it in a PHP include or require statement without adequate sanitization or validation. An attacker can manipulate this parameter to point to arbitrary files on the server filesystem, such as /etc/passwd, WordPress configuration files (wp-config.php), or log files containing PHP payloads.

The attack surface is the WordPress admin-ajax.php endpoint, which is publicly accessible. Since the missing capability check means no authorization gate exists, any authenticated user — including the lowest-privilege Subscriber account — can trigger the vulnerable action. The combination of an unvalidated file path bypasses standard WordPress input sanitization, as the plugin fails to apply functions like sanitize_file_name(), realpath() checks, or allowlist validation to ensure the resolved path resides within the plugin's expected directories.

From a code-level perspective, the vulnerability likely manifests in a pattern similar to:

add_action('wp_ajax_wpmaps_load_template', 'wpmaps_load_template');
// Missing: add_action('wp_ajax_nopriv_...') — but also missing capability check inside

function wpmaps_load_template() {
    // Missing: current_user_can('manage_options') or similar
    $file = $_POST['file_path']; // Unsanitized
    include(WPMAPS_PLUGIN_DIR . '/' . $file); // LFI — attacker controls $file
}

The missing capability check means the include executes regardless of user role, and the unsanitized path allows ../../ traversal to escape the plugin directory. This is a classic CWE-98 (Improper Control of Filename for Include/Require Statement) chained with CWE-862 (Missing Authorization).

Exploitation Scenarios

Scenario 1: Log Poisoning to Remote Code Execution

1. Reconnaissance: An attacker identifies a WordPress site running WP Maps < 4.9.7 via plugin detection (e.g., wp-json/wp/v2/plugins enumeration, WPScan, or checking the plugin's asset URLs like /wp-content/plugins/wp-maps/readme.txt). The attacker registers a Subscriber account.

2. Initial Trigger: The attacker first injects PHP code into a log file. If WordPress debug mode is enabled, the debug.log file records PHP errors including user-supplied inputs (e.g., a crafted User-Agent header in a request to any endpoint, which gets logged). Alternatively, if the server runs Apache, the attacker sends a crafted request with a User-Agent string like <?php system($_GET['cmd']); ?> to generate an entry in access.log or error.log.

3. Weaponization: The attacker crafts a POST request to /wp-admin/admin-ajax.php with action set to the vulnerable AJAX hook (e.g., wpmaps_load_template) and a file_path parameter containing path traversal sequences. Example payload: ../../../../../../var/log/apache2/access.log.

4. Payload Execution: The server-side include() directive parses the log file. The PHP payload previously injected into the log via the User-Agent is now executed by PHP, giving the attacker a webshell with the user's context (typically www-data).

5. Post-Exploitation: The attacker runs ?cmd=id to confirm code execution, then uploads a full webshell, reads wp-config.php for database credentials, creates a new admin user (privilege escalation), and pivots to the database for data exfiltration.

Scenario 2: Configuration File Disclosure and Credential Theft

1. Reconnaissance: Same as above — the attacker targets any WordPress site running WP Maps < 4.9.7.

2. Direct File Inclusion: Without needing log poisoning, the attacker directly includes wp-config.php via path traversal: file_path=../../../../wp-config.php. While PHP includes execute the file (which defines constants but doesn't output them), the attacker can instead read other sensitive files that produce output when included, or use the LFI to read arbitrary file contents via a PHP wrapper if supported (e.g., php://filter/convert.base64-encode/resource=../../../../wp-config.php).

3. Extraction: The attacker retrieves the base64-encoded contents of wp-config.php, decodes it, and obtains the database hostname, username, password, and auth keys.

4. Post-Exploitation: With database credentials, the attacker connects directly to MySQL, extracts user password hashes, injects a new admin user, or reads the entire user table for credential stuffing.

Impact Assessment

The vulnerability has critical business impact despite lacking an official CVSS score. The attack requires only a Subscriber account — which in many WordPress configurations is freely obtainable via self-registration — making the authentication barrier trivial. The combination of missing authorization and local file inclusion enables:

• Remote Code Execution: By including log files, /proc/self/environ, or other writable files containing PHP, the attacker achieves arbitrary PHP execution.
• Full Site Compromise: Complete takeover of the WordPress installation, including theme/plugin file modification, user account manipulation, and backdoor installation.
• Server Compromise: Depending on PHP-FPM pool permissions, the attacker may escape the web root and compromise the entire hosting environment.
• Data Breach: Access to the database via included configuration files exposes customer data, credentials, and transactional information.
• Lateral Movement: The compromised server can serve as a pivot point into the broader network infrastructure.

The blast radius is any WordPress instance with the WP Maps plugin installed — this includes small business sites, e-commerce platforms, and potentially enterprise WordPress deployments. Given WordPress's ~40% web market share and the plugin's install base, the attack surface is substantial.

Detection Guidance

Sigma Rule

title: WP Maps Plugin Local File Inclusion Attempt
id: 9f3a1c7e-5b8d-4e2f-9a1c-3d5f7b9a0c1e
status: experimental
description: Detects path traversal and LFI attempts targeting WP Maps plugin AJAX actions
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2026-16263
logsource:
    category: webserver
    product: apache
detection:
    selection_admin_ajax:
        cs-method: 'POST'
        cs-uri-query|contains: '/wp-admin/admin-ajax.php'
    selection_action:
        cs-uri-query|contains|all:
            - 'wpmaps'
            - 'load'
    selection_lfi:
        cs-uri-query|contains:
            - 'file_path='
            - 'template='
            - 'path='
    selection_traversal:
        cs-uri-query|contains:
            - '..%2f'
            - '..%5c'
            - '%2e%2e%2f'
            - '..%252f'
    condition: selection_admin_ajax and selection_action and selection_lfi and selection_traversal
level: high
falsepositives:
    - Plugin developers testing legitimate template loading
    - Legitimate uses of custom template paths
tags:
    - attack.t1190
    - cve.2026.16263
    - cwe.98
    - cwe.862

YARA Rule

rule WP_Maps_LFI_CVE_2026_16263 {
    meta:
        author = "Valters IT Security Research"
        description = "Detects malicious requests targeting WP Maps plugin LFI vulnerability"
        cve = "CVE-2026-16263"
        date = "2026-01-01"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-16263"
        severity = "high"
    strings:
        $ajax_action = "wpmaps" ascii wide nocase
        $file_param = "file_path" ascii wide nocase
        $path_param = "template" ascii wide nocase
        $traversal1 = "..%2f" ascii wide nocase
        $traversal2 = "..%5c" ascii wide nocase
        $traversal3 = "%2e%2e" ascii wide nocase
        $wp_config = "wp-config.php" ascii wide nocase
        $log_file = ".log" ascii wide nocase
        $etc_passwd = "etc/passwd" ascii wide nocase
        $proc_self = "proc/self" ascii wide nocase
        $php_filter = "php://filter" ascii wide nocase
    condition:
        uint16(0) == 0x0D0A and
        any of ($ajax_action) and
        any of ($file_param, $path_param) and
        2 of ($traversal*) and
        1 of ($wp_config, $log_file, $etc_passwd, $proc_self, $php_filter)
}

Suricata IDS Rule

alert http any any -> any any (msg:"WP Maps Plugin Local File Inclusion Attempt (CVE-2026-16263)"; flow:established,to_server; content:"POST"; http_method; content:"/wp-admin/admin-ajax.php"; http_uri; content:"wpmaps"; http_uri; content:"file_path"; http_client_body; pcre:/(?:\.\.|%2e%2e|%252e%252e)(?:[\/\\]|%2f|%5c|%252f)/i; content:"wp-config.php|.log|etc/passwd|proc/self"; http_client_body; pcre:/\.\.\//i; classtype:web-application-attack; reference:cve,2026-16263; reference:url,nvd.nist.gov/vuln/detail/CVE-2026-16263; sid:202616263; rev:1;)

Elastic Detection

sequence by source.ip with maxspan=5m
  [ network where event.action == "POST" and
    url.path == "/wp-admin/admin-ajax.php" and
    url.query contains "wpmaps" and
    url.query contains "file_path" ]
  [ network where event.action == "GET" or event.action == "POST" and
    url.query matches ".*(\.\.%2f|\.\.%5c|%2e%2e%2f|\.\.%252f).*" ]

Splunk SPL Query

index=web sourcetype="access_combined" 
| search "/wp-admin/admin-ajax.php" "wpmaps"
| search "*file_path*" OR "*template*" OR "*path*"
| search "..%2f" OR "..%5c" OR "%2e%2e%2f" OR "..%252f" OR "..%2e"
| rex field=uri_query "file_path=(?<file_path>[^&]+)"
| rex field=uri_query "action=(?<action>[^&]+)"
| eval suspicious = if(match(file_path, "(wp-config\.php|\.\.\/|etc/passwd|proc/self|\.log|php://filter)"), "LFI_INDICATOR", "REVIEW")
| stats count by src_ip, suspicious, file_path, action, _time
| where suspicious = "LFI_INDICATOR"
| sort - _time
| table _time, src_ip, suspicious, file_path, action, count

Wazuh OSSEC Rule

<group name="wordpress,web_attack,cve_2026_16263,">
  <rule id="100263" level="12">
    <decoded>web-accesslog</decoded>
    <match>wp-admin/admin-ajax.php</match>
    <regex>(\.\.%2f|\.\.%5c|%2e%2e%2f|\.\.%252f)</regex>
    <regex>file_path|template=|path=</regex>
    <regex>wpmaps</regex>
    <description>WP Maps Plugin Local File Inclusion Attempt (CVE-2026-16263)</description>
    <group>attack.t1190,</group>
    <mitre>
      <id>T1190</id>
    </mitre>
    <cve>CVE-2026-16263</cve>
    <info type="link">https://nvd.nist.gov/vuln/detail/CVE-2026-16263</info>
  </rule>
</group>

Mitigation & Patch Guidance

Patch Confidence: 2/4 — CLAIMED — single source (NVD) claims a patch exists in version 4.9.7, but this is not independently confirmed by the vendor or a security researcher.

Immediate Mitigations (no downtime):

1. Disable user registration: If self-registration is enabled, disable it to prevent new Subscriber accounts from being created. Audit and delete suspicious low-privilege accounts.
2. Restrict AJAX endpoint access: Use a WAF rule to block requests to /wp-admin/admin-ajax.php that reference WP Maps actions (wpmaps) unless originating from authenticated admin sessions. Example WAF rule: block any admin-ajax.php POST containing wpmaps with a file_path parameter.
3. Disable PHP error logging to web-accessible paths: Ensure debug.log is not writable by the web server user, and configure Apache/Nginx to restrict log file access via filesystem permissions.
4. Monitor file integrity: Use a file integrity monitoring tool (Tripwire, OSSEC, AIDE) to detect unauthorized modifications to WordPress core files, wp-config.php, and the plugin directory.

Patch/Upgrade Steps:

1. Verify the fix: Confirm that version 4.9.7 actually addresses the vulnerability. Check the plugin changelog and test that the AJAX action now includes a current_user_can() capability check and proper path validation (e.g., realpath() comparison).
2. Upgrade: Navigate to wp-admin/plugin-install.php or use WP-CLI to update the WP Maps plugin:

   wp plugin update wp-maps --version=4.9.7
   

3. If the patched version is unavailable or unconfirmed: Consider temporarily deactivating and deleting the plugin until the patch is verified. Search for alternative WordPress map plugins that are actively maintained.

Long-Term Hardening:

1. Least privilege: Audit all plugins for missing capability checks. Use plugins like Wordfence or WPScan to scan for known vulnerabilities.
2. Harden wp-config.php: Move it outside the web root if possible, or add filesystem permissions (600).
3. Critical file protection: Use a security plugin that restricts direct access to debug.log, .log files, and configuration files.
4. Regular vulnerability scanning: Integrate WordPress plugin scanning into vulnerability management workflows (Qualys, Nessus, or WPScan CLI in CI/CD).
5. Maintain credentials hygiene: Rotate all database passwords and WordPress admin credentials if any compromise is suspected.

References

1. NVD Entry: https://nvd.nist.gov/vuln/detail/CVE-2026-16263 — Official CVE record; primary source for vulnerability description and affected version data.
2. WordPress Plugin Repository: https://wordpress.org/plugins/wp-maps/ — Official distribution channel; check the changelog for version 4.9.7 and confirm the security fix.
3. OWASP LFI Prevention Cheat Sheet: https://cheatsheetseries.owasp.org/cheatsheets/File_Upload_Cheat_Sheet.html — Reference for local file inclusion mitigation strategies applicable to this plugin.
4. MITRE ATT&CK Technique T1190: https://attack.mitre.org/techniques/T1190/ — Exploitation of Public-Facing Application; the primary tactic mapping for this vulnerability class.

Threat Actor Activity: At the time of this report, there are no known exploitation campaigns in the wild, no CISA KEV listing, no public PoC, and no exploit code published. The absence of public exploit evidence should not downgrade the risk — LFI-to-RCE chains are well-documented and trivial to script once the vulnerable endpoint is identified. Monitor vendor communications and security feeds for updates on in-the-wild activity.