MapSVG Lite CVE-2026-111398

Exploitation requires an authenticated session at a low privilege level (CVSS PR:L) on a WordPress site running the MapSVG Lite (mapsvg-lite-interactive-vector-maps) plugin at version 8.16.1 or earlier; the attacker then supplies traversal sequences to a plugin file-handling parameter to reach files outside the plugin's intended directory. The primary limiting factor is the authentication requirement - sites that do not permit untrusted user registration or low-privilege accounts substantially reduce exposure. No user interaction is needed (UI:N), and no special non-default configuration is indicated by the advisory, so default installs of the vulnerable version are affected once the attacker has an account.

This is a genuine but conditional-priority issue rather than a drop-everything emergency. The provided CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H, score 7.7 High) indicates network-reachable, low-complexity exploitation that requires some level of authentication (PR:L) and no user interaction, with a changed scope and high availability impact (arbitrary file deletion) but no direct confidentiality or integrity impact modeled. There is no KEV listing and no POC flag in the supplied data, so exploitation status is 'no public exploit identified at time of analysis.' No EPSS score was provided, so exploitation probability cannot be quantified. The PR:L requirement is the single most important risk-reducer: an attacker needs a valid (even low-privilege) WordPress account, which is why this ranks High rather than Critical despite being network-based and unauthenticated-adjacent. Note a modeling nuance worth verifying with the vendor: the advisory title describes 'arbitrary file deletion,' which the CVSS vector captures as A:H with I:N - deletion of files is treated purely as an availability impact, so defenders should not assume data tampering/integrity consequences from the base vector alone. Overall: a real, patchable risk for sites that allow untrusted low-privilege accounts, but lower practical urgency for single-admin installations.

An attacker who holds or registers a low-privilege authenticated account on a WordPress site running MapSVG Lite ≤8.16.1 submits a crafted request to a plugin endpoint containing directory-traversal sequences in a filename parameter. Because the plugin fails to restrict the pathname to its intended directory, the request deletes arbitrary files on the server (e.g., wp-config.php or core files), causing site outage or forcing an insecure reinstall state. No public exploit code is identified at time of analysis, and low attack complexity means a working exploit would be straightforward to develop.