EUVD-2026-65313
GHSA-5ph3-fc6c-c54j
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Subscriber-level auth (PR:L) required; nonce self-service via client-side JS confirms AC:L and AV:N; RCE potential justifies C:H/I:H/A:H with unchanged scope.
Primary rating from Vendor (Wordfence).
CVSS VectorVendor: Wordfence
Lifecycle Timeline
2DescriptionCVE.org
The CM Map Locations - Visualize and share your locations in a few clicks plugin for WordPress is vulnerable to Limited Arbitrary File Upload in all versions up to, and including, 2.1.8 via the uploadMedia function. This is due to insufficient file type validation in the upload handler, which performs incomplete extension filtering without MIME-type checks or upload capability verification before passing attacker-supplied files to move_uploaded_file(). This makes it possible for authenticated attackers, with subscriber-level access and above, to upload files that may be executable, which makes remote code execution possible. The required nonce is exposed to any logged-in Subscriber via the CMLOC_Editor_Images JavaScript object on the front-end location editor page.
AnalysisAI
Remote code execution is possible in CM Map Locations WordPress plugin (all versions ≤ 2.1.8) via a limited arbitrary file upload flaw in the uploadMedia function, exploitable by any subscriber-level authenticated user. The upload handler performs only incomplete extension filtering with no MIME-type checks or WordPress capability verification before passing attacker-supplied files to move_uploaded_file(), and the required nonce is automatically exposed to any logged-in subscriber via the CMLOC_Editor_Images JavaScript object on the front-end location editor. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires a valid WordPress account with subscriber-level access or higher - the lowest authenticated role, obtainable for free on any site with open user registration enabled. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 8.8 score (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) accurately reflects the threat profile. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Update CM Map Locations to version 2.1.9 or later, which patches the insufficient file type validation per the confirmed SVN changeset at https://plugins.trac.wordpress.org/changeset/3626848/cm-map-locations/trunk/controller/DashboardController.php. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, immediately disable the CM Map Locations plugin, preserve current server logs for forensic analysis, and restrict new subscriber account creation through WordPress user registration settings. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same technique File Upload
View allShare
External POC / Exploit Code
Leaving vuln.today