MapSVG CVE-2026-111406

Requires an authenticated WordPress session with at least a low-privileged role (indicated by CVSS PR:L; the exact minimum role is not specified in the description) on a site running the MapSVG (mapsvg-lite-interactive-vector-maps) plugin version 8.16.1 or earlier. The flaw is the plugin's failure to restrict uploaded file types (CWE-434), allowing a dangerous file such as a PHP web shell to be written to a web-accessible location. Limiting factors: exploitation is bounded by the need for a valid account and by whether the site permits low-privileged user registration or the attacker can otherwise acquire credentials; no user interaction is required (UI:N) and attack complexity is low (AC:L).

This is a genuine high-priority issue, not merely a high-CVSS-but-low-real-risk flaw. The provided CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H, 9.9) describes a network-reachable, low-complexity, low-privilege arbitrary file upload (CWE-434) that results in web shell deployment - effectively remote code execution with a scope change to the underlying web server. Because PR:L is present, exploitation requires some authenticated account (per the vendor pattern for Patchstack WordPress findings, typically a low-privileged role such as contributor/author), which is the single most important mitigating factor; it is not unauthenticated. No EPSS score, no CISA KEV listing, and no POC indicator were supplied, so exploitation likelihood cannot be quantified and there is no public exploit identified at time of analysis. The signals are internally consistent (file-upload-to-web-shell squarely matches the CWE and the Scope:Changed/High-impact metrics), so the main uncertainty is operational: EPSS and KEV data are absent, meaning real-world exploitation volume is unknown despite the critical technical severity. Treat as urgent to patch wherever the plugin is installed and low-privileged account registration is possible, but recognize the authentication requirement bounds mass, unauthenticated exploitation.

An attacker who holds or obtains a low-privileged authenticated WordPress account on a site running MapSVG ≤ 8.16.1 abuses the plugin's unvalidated upload functionality to upload a PHP web shell to a web-accessible directory. They then request the uploaded file to execute arbitrary commands as the web server user, achieving full site and server compromise. No public proof-of-concept was provided in the input, and the low attack complexity (AC:L) means no special timing or conditions are needed once authenticated.