What is the CVSS score of CVE-2025-47559?

CVE-2025-47559 has a CVSS 3.1 base score of 9.9 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of Wordpress Plugin are affected by CVE-2025-47559?

A critical vulnerability in MapSVG (versions through 8.5.32) allows attackers to upload malicious web shells, potentially giving them complete control of affected web servers.

How to fix or mitigate CVE-2025-47559?

Within 24 hours: Identify all systems running MapSVG and immediately disable the file upload functionality if operationally feasible, or restrict access to MapSVG administrative interfaces to trusted networks only. Within 7 days: Implement Web Application Firewall (WAF) rules to block suspicious file uploads and monitor for indicators of compromise (web shell artifacts, unauthorized admin access). Within 30 days: Develop a migration plan to either upgrade to a patched version when available or replace MapSVG with an alternative solution; conduct forensic analysis of affected systems for signs of breach.

Wordpress Plugin CVE-2025-47559

EUVD-2025-18540 CRITICAL

Unrestricted Upload of File with Dangerous Type (CWE-434)

2025-06-17 audit@patchstack.com

WordPress File Upload Wordpress Plugin

9.9

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

9.9 CRITICAL

AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Re-analysis Queued

Apr 23, 2026 - 15:42 vuln.today

cvss_changed

EUVD ID Assigned

Mar 14, 2026 - 22:15 euvd

EUVD-2025-18540

Analysis Generated

Mar 14, 2026 - 22:15 vuln.today

CVE Published

Jun 17, 2025 - 15:15 nvd

CRITICAL 9.9

DescriptionCVE.org

Unrestricted Upload of File with Dangerous Type vulnerability in RomanCode MapSVG allows Upload a Web Shell to a Web Server. This issue affects MapSVG: from n/a through 8.5.32.

AnalysisAI

CVE-2025-47559 is an unrestricted file upload vulnerability in RomanCode MapSVG that allows authenticated users to upload and execute arbitrary web shells on affected servers. The vulnerability impacts MapSVG versions through 8.5.32, enabling attackers with valid login credentials to achieve complete system compromise (confidentiality, integrity, and availability). With a CVSS score of 9.9 and active exploitation risk indicated by the low attack complexity and widespread impact potential, this represents a critical threat to MapSVG deployments.

Technical ContextAI

MapSVG is a WordPress plugin/web application library that handles SVG map creation and manipulation. The vulnerability stems from CWE-434 (Unrestricted Upload of File with Dangerous Type), a common file upload validation flaw where the application fails to properly restrict file types during upload operations. The root cause involves insufficient validation of file extensions, MIME types, or content inspection before accepting uploaded files. This allows attackers to bypass security controls and upload executable code (web shells in PHP, JSP, ASP.NET, etc.) that the web server will interpret and execute with the privileges of the web application. The affected CPE would be represented as cpe:2.3:a:romancode:mapsvg:*:*:*:*:*:wordpress:*:* with versions 8.5.32 and earlier being vulnerable.