CVE-2026-65455
A critical vulnerability in MapSVG versions 8.14.0 and earlier allows administrators to upload arbitrary files, potentially leading to remote code execution. The flaw can be exploited over the network with low effort and high impact. It is classified as critical due to its severity score of 9.1.
No official fix yet. If none appears within 45 days of first tracking, this entry is removed automatically.
Who is affected
MapSVG plugin for WordPress, versions 8.14.0 and earlier. Typical users are website administrators who manage the plugin.
Real-world impact
An attacker who gains administrator access could upload malicious files, which may be executed on the server, allowing full control over the website or server.
Why this severity
The CVSS score of 9.1 reflects that the vulnerability is exploitable over the network with low complexity, requires high privileges, and can compromise confidentiality, integrity, and availability.
What to do about it
- ›Upgrade MapSVG to a version newer than 8.14.0 if one is available.
- ›If no update is available, restrict or disable the file upload feature for administrators until a patch is released.
No official fix or mitigation is documented in the sources yet. Monitor the vendor advisory and apply the patch as soon as it is released.
No fix documented in sources