CVE-2025-12062

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-12062", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "state": "PUBLISHED", "assignerShortName": "Wordfence", "dateReserved": "2025-10-22T12:09:20.000Z", "datePublished": "2026-02-16T23:22:38.266Z", "dateUpdated": "2026-04-08T17:03:44.114Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T17:03:44.114Z"}, "affected": [{"vendor": "flippercode", "product": "WP Maps \u2013 Store Locator,Google Maps,OpenStreetMap,Mapbox,Listing,Directory & Filters", "versions": [{"version": "0", "status": "affected", "lessThanOrEqual": "4.8.6", "versionType": "semver"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "The WP Maps \u2013 Store Locator,Google Maps,OpenStreetMap,Mapbox,Listing,Directory & Filters plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 4.8.6 via the fc_load_template function. This makes it possible for authenticated attackers, with Subscriber-level access and above, to include and execute arbitrary .html files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where .html file types can be uploaded and included."}], "title": "WP Maps <= 4.8.6 - Authenticated (Subscriber+) Limited Local File Inclusion", "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/815e5b86-2d1b-4794-b761-dad770393d3e?source=cve"}, {"url": "https://plugins.trac.wordpress.org/changeset/3405282/"}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')", "cweId": "CWE-22", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "baseScore": 8.8, "baseSeverity": "HIGH"}}], "credits": [{"lang": "en", "type": "finder", "value": "Michael Mazzolini"}], "timeline": [{"time": "2025-10-13T00:00:00.000Z", "lang": "en", "value": "Discovered"}, {"time": "2026-02-16T10:59:48.000Z", "lang": "en", "value": "Disclosed"}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-02-17T14:40:21.145373Z", "id": "CVE-2025-12062", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-02-17T14:40:45.231Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-12062", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-02-17T14:40:21.145373Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-02-17T14:40:40.572Z"}}], "cna": {"title": "WP Maps <= 4.8.6 - Authenticated (Subscriber+) Limited Local File Inclusion", "credits": [{"lang": "en", "type": "finder", "value": "Michael Mazzolini"}], "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 8.8, "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"}}], "affected": [{"vendor": "flippercode", "product": "WP Maps \u2013 Store Locator,Google Maps,OpenStreetMap,Mapbox,Listing,Directory & Filters", "versions": [{"status": "affected", "version": "0", "versionType": "semver", "lessThanOrEqual": "4.8.6"}], "defaultStatus": "unaffected"}], "timeline": [{"lang": "en", "time": "2025-10-13T00:00:00.000Z", "value": "Discovered"}, {"lang": "en", "time": "2026-02-16T10:59:48.000Z", "value": "Disclosed"}], "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/815e5b86-2d1b-4794-b761-dad770393d3e?source=cve"}, {"url": "https://plugins.trac.wordpress.org/changeset/3405282/"}], "descriptions": [{"lang": "en", "value": "The WP Maps \u2013 Store Locator,Google Maps,OpenStreetMap,Mapbox,Listing,Directory & Filters plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 4.8.6 via the fc_load_template function. This makes it possible for authenticated attackers, with Subscriber-level access and above, to include and execute arbitrary .html files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where .html file types can be uploaded and included."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-22", "description": "CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')"}]}], "providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T17:03:44.114Z"}}}, "cveMetadata": {"cveId": "CVE-2025-12062", "state": "PUBLISHED", "dateUpdated": "2026-04-08T17:03:44.114Z", "dateReserved": "2025-10-22T12:09:20.000Z", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "datePublished": "2026-02-16T23:22:38.266Z", "assignerShortName": "Wordfence"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "WP Maps \u2013 Store Locator,Google Maps,OpenStreetMap,Mapbox,Listing,Directory & Filters", "vendor": "flippercode", "versions": [{"lessThanOrEqual": "4.8.6", "status": "affected", "version": "0", "versionType": "semver"}]}], "source": "security@wordfence.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "The WP Maps \u2013 Store Locator,Google Maps,OpenStreetMap,Mapbox,Listing,Directory & Filters plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 4.8.6 via the fc_load_template function. This makes it possible for authenticated attackers, with Subscriber-level access and above, to include and execute arbitrary .html files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where .html file types can be uploaded and included."}, {"lang": "es", "value": "El plugin WP Maps \u2013 Store Locator,Google Maps,OpenStreetMap,Mapbox,Listing,Directory &amp; Filters para WordPress es vulnerable a inclusi\u00f3n local de ficheros en todas las versiones hasta la 4.8.6, inclusive, a trav\u00e9s de la funci\u00f3n fc_load_template. Esto hace posible que atacantes autenticados, con acceso de nivel Suscriptor y superior, incluyan y ejecuten ficheros .html arbitrarios en el servidor, permitiendo la ejecuci\u00f3n de cualquier c\u00f3digo PHP en esos ficheros. Esto puede usarse para eludir los controles de acceso, obtener datos sensibles o lograr la ejecuci\u00f3n de c\u00f3digo en casos donde los tipos de fichero .html pueden ser subidos e incluidos."}], "id": "CVE-2025-12062", "lastModified": "2026-06-17T08:31:39.240", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 5.9, "source": "security@wordfence.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-12062", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-02-17T14:40:21.145373Z", "version": "2.0.3"}}]}, "published": "2026-02-17T00:16:17.080", "references": [{"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/changeset/3405282/"}, {"source": "security@wordfence.com", "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/815e5b86-2d1b-4794-b761-dad770393d3e?source=cve"}], "sourceIdentifier": "security@wordfence.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-22"}], "source": "security@wordfence.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,4.8.6]"}}], "product": "wp_maps_\u2013_store_locator,google_maps,openstreetmap,mapbox,listing,directory_&_filters", "vendor": "flippercode"}, {"configurations": [{"platform": null, "status": "unaffected", "versions": null}], "product": "wordpress", "vendor": "wordpress"}], "analysis": {"en": {"generated_at": "2026-04-22T12:12:55.070015+00:00", "value": {"mitigation_remediation": ["Upgrade the WP Maps plugin to the latest official release (greater than version 4.8.6) to eliminate the local file inclusion flaw.", "If an upgrade is not immediately possible, configure WordPress or the plugin to disallow uploading of .html files or enforce strict file type validation to prevent execution of PHP code.", "Review the plugin's upload directories for existing .html files, remove any that contain or could contain PHP code, and set appropriate file permissions to prevent unintended execution."], "summary": {"action": "Patch Now", "impact": "Remote Code Execution"}, "threat_synthesis": {"affected_systems": "All installations of the WP Maps \u2013 Store Locator, Google Maps, OpenStreetMap, Mapbox, Listing, Directory & Filters plugin for WordPress up to and including version 4.8.6 are affected. The plugin is maintained by flippercode. Upgrading to any version newer than 4.8.6 removes this vulnerability.", "description_and_impact": "The WP Maps plugin contains a local file inclusion flaw in its fc_load_template function. Authenticated users with Subscriber privileges or higher can supply a path to an arbitrary .html file that the server will include. Because .html files may contain PHP code, the attacker can execute arbitrary PHP, effectively enabling remote code execution and the ability to bypass access controls and access sensitive data.", "risk_and_exploitability": "The CVSS score of 8.8 indicates high severity. The EPSS score is less than 1\u202f%, suggesting low observed exploitation probability at this moment, and the vulnerability is not listed in CISA\u2019s KEV catalog. The attack requires an authenticated account with Subscriber privileges or higher and the ability to upload or otherwise place an executable .html file on the server. Once such a file exists, the attacker can trigger fc_load_template to include the file, leading to code execution. The limited local file inclusion nature means the vulnerability is not exploitable remotely by unauthenticated users."}}}}, "created": "2026-02-17T08:48:56.592297+00:00", "updated": "2026-04-22T12:15:16.038633+00:00", "vendors": ["flippercode", "flippercode$PRODUCT$wp_maps_\u2013_store_locator,google_maps,openstreetmap,mapbox,listing,directory_&_filters", "wordpress", "wordpress$PRODUCT$wordpress"]}