{
 "id": "WPSEC-2026-1768",
 "url": "https://wpsec.com/vuln/WPSEC-2026-1768/",
 "json_url": "https://wpsec.com/vuln/WPSEC-2026-1768/advisory.json",
 "markdown_url": "https://wpsec.com/vuln/WPSEC-2026-1768/index.md",
 "title": "WP GPX Maps <= 1.7.11 - Authenticated (Contributor+) Path Traversal via 'gpx' and 'folder' Shortcode Attributes",
 "description": "The WP GPX Maps plugin for WordPress is vulnerable to Path Traversal via the 'gpx' attribute of the [sgpx] shortcode and the 'folder' attribute of the [sgpxf] shortcode in all versions up to, and including, 1.7.11. This is due to the attribute values being appended to the site path without checking that the resulting path stays inside the site. This makes it possible for authenticated attackers, with contributor-level access and above, to make the plugin read and parse GPX/XML files outside the intended folders anywhere on the server, and to show the parsed track data from those files on the page.",
 "plugin": {
  "slug": "wp-gpx-maps",
  "name": "WP GPX Maps",
  "full_name": "WP GPX Maps",
  "wordpress_org": "https://wordpress.org/plugins/wp-gpx-maps/",
  "advisories_url": "https://wpsec.com/vuln/plugin/wp-gpx-maps/",
  "attacksurface": "https://attacksurface.wpsec.com/plugin/wp-gpx-maps"
 },
 "type": "TRAVERSAL",
 "cwe": [
  "CWE-22"
 ],
 "cve": [],
 "cvss": {
  "version": "3.1",
  "score": 4.3,
  "vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
  "severity": "Medium"
 },
 "affected": {
  "ranges": [
   {
    "from": null,
    "from_inclusive": true,
    "to": "1.8.00",
    "to_inclusive": false
   }
  ],
  "text": [
   "all versions before 1.8.00"
  ]
 },
 "introduced_in": null,
 "fixed_in": "1.8.00",
 "remediation": "Update to 1.8.00 or later.",
 "fix_released": "2026-10-26T14:54:50+00:00",
 "published": "2026-10-27T15:50:45+00:00",
 "updated": "2026-10-27T13:05:08.981057+00:00",
 "also_published_as": null,
 "references": [
  "https://wpsec.com/vuln/WPSEC-2026-1768/",
  "https://plugins.svn.wordpress.org/wp-gpx-maps/tags/1.8.00/",
  "https://wordpress.org/plugins/wp-gpx-maps/"
 ],
 "attacksurface_url": "https://attacksurface.wpsec.com/plugin/wp-gpx-maps",
 "source": "WPSec",
 "license": {
  "name": "CC BY 4.0",
  "url": "https://creativecommons.org/licenses/by/4.0/"
 },
 "usage": {
  "plugin": "Low",
  "affected_versions": "Low",
  "as_of": "2026-10-27"
 }
}