CyberRota Analysis
AI-GeneratedThe WP MAPS PRO plugin for WordPress prior to version 6.1.3 is vulnerable due to a lack of capability checks in an AJAX action accessible to unauthenticated users, enabling attackers to include and execute arbitrary PHP files on the server. This vulnerability poses a significant risk of remote code execution, potentially compromising the integrity and confidentiality of the affected WordPress site. WordPress administrators using this plugin should prioritize updating to the latest version to mitigate the risk.
Original NVD Description
The WP MAPS PRO WordPress plugin before 6.1.3 does not perform a capability check in one of its AJAX actions, which is also available to unauthenticated users, and does not properly validate a user-controlled path before using it in a file inclusion, allowing unauthenticated attackers to include and execute arbitrary existing local PHP files on the server.