CVE-2026-111406: WordPress MapSVG plugin <= 8.16.1 - Arbitrary File Upload vulnerability
Unrestricted Upload of File with Dangerous Type vulnerability in PT Norther Lights Production MapSVG mapsvg-lite-interactive-vector-maps allows Upload a Web Shell to a Web Server.This issue affects MapSVG: from n/a through 8.16.1.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
WordPress MapSVG mapsvg-lite-interactive-vector-mapsto a version that resolves this vulnerability.Fixed in 8.16.2
Event History
Frequently Asked Questions
Who can exploit this issue?
An attacker needs at least low-level privileges (PR:L) and network access. No user interaction is required.
What is the likely impact if exploitation succeeds?
The vulnerability allows upload of a web shell to the server. The supplied vector indicates high confidentiality, integrity, and availability impact, with scope changed.
Which versions are affected?
MapSVG versions through 8.16.1 are affected. The provided data does not identify a fixed version.
Are default installations known to be affected?
The available information does not state whether the vulnerable upload functionality is enabled or reachable in a default installation.