WordPress Plugin Vulnerabilities

MapSVG < 8.14.1 - Admin+ Arbitrary File Upload via SVGFile Endpoint

Description

The plugin does not properly validate the type of uploaded files, due to an incorrect conditional check that prevents the validation from taking place. This allows authenticated attackers with Administrator-level access and above to upload arbitrary files to the affected site's server, which may lead to remote code execution.

Affects Plugins

Plugin icon
mapsvg-lite-interactive-vector-maps
Fixed in 8.14.1

References

CVE
CVE-2026-1771
URL
https://www.wordfence.com/threat-intel/vulnerabilities/id/c7f098b9-eca3-41c7-9c74-0f4b3f75c915

Miscellaneous

Original Researcher
san6051
Verified
No
WPVDB ID
b8b37128-adf8-4e18-9a31-67cbb9ee9968

Timeline

Publicly Published
2026-07-20 (about 2 months ago)
Added
2026-07-20 (about 2 months ago)
Last Updated
2026-07-20 (about 2 months ago)

Other

Published
Title
Published
2025-04-21
Title
Greenshift 11.4 - 11.4.5 - Authenticated (Subscriber+) Arbitrary File Upload
Published
2025-01-20
Title
Post/Page Copying Tool to Export and Import post/page for Cross site Migration < 2.0.4 - Authenticated (Contributor+) Arbitrary File Upload
Published
2024-10-17
Title
photokit <= 1.0 - Unauthenticated Arbitrary File Upload
Published
2020-10-11
Title
PowerPress < 8.3.8 - Authenticated Arbitrary File Upload leading to RCE
Published
2014-08-01
Title
Annonces 1.2.0.1 - Shell Upload