Security Alert Summary
The WP Maps – Store Locator,Google Maps,OpenStreetMap,Mapbox,Listing,Directory & Filters plugin for WordPress contains a Local File Inclusion (LFI) vulnerability in the fc_load_template function. Authenticated users with Subscriber-level access and above can include and execute arbitrary .html files on the server, which may allow execution of PHP code embedded in those files, bypassing access controls and exposing sensitive data or enabling code execution in some upload scenarios.
CVE Details
- CVE ID: CVE-2025-12062
- Affected component: WP Maps – Store Locator,Google Maps,OpenStreetMap,Mapbox,Listing,Directory & Filters plugin for WordPress
- Affected versions: All versions up to and including 4.8.6
- Published: February 17, 2026 at 12:16 AM (UTC)
- Last modified: February 17, 2026 at 12:16 AM (UTC)
- CVSS v3.1: Base Score 8.8, Severity: HIGH
Vector:CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - Authentication / Privileges / User Interaction: Authenticated attacker required; privileges required: low (Subscriber-level and above per description); user interaction: none
- Primary impact: Confidentiality: High; Integrity: High; Availability: High
- CWE / weakness: CWE-22 (Path Traversal)
Technical Details
The vulnerability is a Local File Inclusion issue in the plugin’s fc_load_template function. Due to insufficient validation or sanitization of file path input, an authenticated user with Subscriber-level access or higher can cause the plugin to include arbitrary .html files from the server. Because the plugin includes those files in a context where their contents are processed, embedded PHP code in such .html files can be executed in environments that allow PHP execution from included files with that extension.
The described impact includes bypassing access controls, disclosure of sensitive data, and potential code execution in cases where .html files can be uploaded and subsequently included. The CVE description specifically names the fc_load_template function as the inclusion point; no REST API endpoints or other functions are named in the provided data.
How This Could Impact Your Website
Consider a small organization with a site owner, several internal staff users (editor and author roles), and an external contractor who contributes content. If any of these accounts has Subscriber-level access or higher and an attacker can leverage this vulnerability, the attacker could cause the site to include an attacker-controlled .html file. Practical consequences include exposure of internal user email addresses and other sensitive content, and an increased risk of targeted phishing or social engineering against staff whose information is exposed. Depending on the hosting environment and upload settings, this could also enable execution of arbitrary code.
If you’re unsure whether your site is affected or how to assess your current user roles and plugins, it may be worth having a professional review your setup.
Recommended Actions
- Update the affected plugin as soon as a patched version is available. The CVE entry does not specify a fixed or patched version.
- Review and reduce unnecessary user roles and capabilities, especially for contributors and other lower-privilege accounts.
- Enforce strong passwords and enable two-factor authentication for editors and administrators.
- Remove unused or unmaintained plugins from your site.
- Monitor site activity and logs for unusual behavior, unexpected file uploads, or unauthorized inclusions.
If you’d like help reviewing your plugins, user roles, or overall WordPress security posture, our team at Freshy is happy to help.
