{"cvss":8.8,"datePublished":"2026-10-13T00:00:00Z","dateUpdated":"2026-10-13T00:00:00Z","description":"The WP Maps  WordPress plugin before 4.9.7 does not perform a capability check in one of its AJAX actions and does not properly validate a user-controlled path before using it in a file inclusion, allowing users with a Subscriber account to include and execute arbitrary existing local PHP files on the server.","dueDate":"","id":"CVE-2026-16263","kev_catalogs":["vulncheck"],"knownRansomwareCampaignUse":"Unknown","product":"wp_maps","requiredAction":"Apply remediations or mitigations per vendor instructions or discontinue use of the product if remediation or mitigations are unavailable.","severity":"HIGH","source":"vulncheck_kev","title":"weplugins wp_maps Improper Limitation of a Pathname to a Restricted Directory","vendor":"weplugins"}