Arbitrary file upload in MapSVG plugin for WordPress (CVE-2026-1771)

The MapSVG plugin for WordPress contains a missing file type validation flaw in the SVGFile constructor, caused by an incorrect conditional check that prevents validation from executing. Authenticated attackers with Administrator-level access or above can exploit this via the `/mapsvg/v1/svgfile` endpoint to upload arbitrary files to the server, potentially enabling remote code execution. Affected versions: - <= 8.14.0 We recommend updating to: 8.14.1. CVSS 7.2 · our assessment: this_week Reference: https://www.wordfence.com/threat-intel/vulnerabilities/id/c7f098b9-eca3-41c7-9c74-0f4b3f75c915?source=cve Details: https://vuln.today/cve/CVE-2026-1771