# WP GPX Maps <= 1.7.11 - Authenticated (Contributor+) Path Traversal via 'gpx' and 'folder' Shortcode Attributes

- **ID:** WPSEC-2026-1768
- **Plugin:** WP GPX Maps (`wp-gpx-maps`), https://wordpress.org/plugins/wp-gpx-maps/
- **Affected versions:** all versions before 1.8.00
- **Fixed in:** 1.8.00 (Update to 1.8.00 or later.)
- **Severity:** Medium 4.3 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N)
- **Weakness:** CWE-22
- **Usage among sites WPSec scans:** plugin Low, affected versions Low (as of 2026-10-27)
- **Attack surface analysis:** https://attacksurface.wpsec.com/plugin/wp-gpx-maps
- **Fix released:** 2026-10-26
- **Published:** 2026-10-27
- **URL:** https://wpsec.com/vuln/WPSEC-2026-1768/

## Description

The WP GPX Maps plugin for WordPress is vulnerable to Path Traversal via the 'gpx' attribute of the [sgpx] shortcode and the 'folder' attribute of the [sgpxf] shortcode in all versions up to, and including, 1.7.11. This is due to the attribute values being appended to the site path without checking that the resulting path stays inside the site. This makes it possible for authenticated attackers, with contributor-level access and above, to make the plugin read and parse GPX/XML files outside the intended folders anywhere on the server, and to show the parsed track data from those files on the page.

## References

- https://wpsec.com/vuln/WPSEC-2026-1768/
- https://plugins.svn.wordpress.org/wp-gpx-maps/tags/1.8.00/
- https://wordpress.org/plugins/wp-gpx-maps/

Source: WPSec, https://wpsec.com/vuln/WPSEC-2026-1768/

License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Free to use, share and adapt, also commercially, if you credit WPSec and link to this advisory.