Vulnerabilities / WP GPX Maps / WPSEC-2026-1768
WP GPX Maps <= 1.7.11 - Authenticated (Contributor+) Path Traversal via 'gpx' and 'folder' Shortcode Attributes
Medium 4.3
CWE-22Fixed in 1.8.00
- ID
- WPSEC-2026-1768
- Plugin
- WP GPX Maps (wp-gpx-maps)
- Affected
- all versions before 1.8.00
- Remediation
- Update to 1.8.00 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
- Weakness
- CWE-22
- Usage
- Plugin Low · Affected versions Low among sites WPSec scans, 2026-10-27
- Attack surface
- WP GPX Maps on WPSec AttackSurface
- Fix released
- Published
Description
The WP GPX Maps plugin for WordPress is vulnerable to Path Traversal via the 'gpx' attribute of the [sgpx] shortcode and the 'folder' attribute of the [sgpxf] shortcode in all versions up to, and including, 1.7.11. This is due to the attribute values being appended to the site path without checking that the resulting path stays inside the site. This makes it possible for authenticated attackers, with contributor-level access and above, to make the plugin read and parse GPX/XML files outside the intended folders anywhere on the server, and to show the parsed track data from those files on the page.
References
- https://wpsec.com/vuln/WPSEC-2026-1768/
- https://plugins.svn.wordpress.org/wp-gpx-maps/tags/1.8.00/
- https://wordpress.org/plugins/wp-gpx-maps/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS