CVE-2026-16601: CM Map Locations <= 2.1.8 - Authenticated (Subscriber+) Arbitrary File Upload via cmloc_route_image_upload AJAX Action
The CM Map Locations – Visualize and share your locations in a few clicks plugin for WordPress is vulnerable to Limited Arbitrary File Upload in all versions up to, and including, 2.1.8 via the uploadMedia function. This is due to insufficient file type validation in the upload handler, which performs incomplete extension filtering without MIME-type checks or upload capability verification before passing attacker-supplied files to moveuploadedfile(). This makes it possible for authenticated attackers, with subscriber-level access and above, to upload files that may be executable, which makes remote code execution possible. The required nonce is exposed to any logged-in Subscriber via the CMLOCEditorImages JavaScript object on the front-end location editor page.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
Any authenticated WordPress user with Subscriber-level access or higher can exploit it. The required nonce is available to logged-in Subscribers through the CMLOC_Editor_Images JavaScript object on the front-end location editor page.
What access or interaction does an attacker need?
An attacker needs a valid authenticated WordPress account at Subscriber level or above. No user interaction is required once the attacker is logged in.
What is the likely impact of successful exploitation?
An attacker may upload files that are executable because the upload handler does not adequately validate file types. This can make remote code execution possible, with potential impact to confidentiality, integrity, and availability.
How can I determine whether my site is affected?
A site is affected if it uses the CM Map Locations plugin at version 2.1.8 or earlier. Review whether untrusted or low-privileged users have Subscriber-level accounts, especially where they can access the front-end location editor.