CM Map Locations CVE-2026-16601

Exploitation requires a valid WordPress account with subscriber-level access or higher - the lowest authenticated role, obtainable for free on any site with open user registration enabled. The CM Map Locations plugin must be installed and active at version 2.1.8 or earlier. The attacker must visit the front-end location editor page while logged in to retrieve the security nonce from the CMLOC_Editor_Images JavaScript object; no special navigation or prior knowledge is needed beyond awareness of the plugin. Full RCE impact is additionally conditioned on: (1) the attacker identifying an executable extension not blocked by the incomplete filter (e.g., .php5, .phtml, .shtml), and (2) the web server being configured to execute such files in the plugin's upload directory - if PHP execution is disabled there via .htaccess or server config, impact is limited to unauthorized file write. Exploitation is limited to authenticated users; unauthenticated access is not possible per the PR:L CVSS metric.

The CVSS 8.8 score (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) accurately reflects the threat profile. The network attack vector and low complexity are confirmed by the nonce being exposed client-side to any logged-in user, eliminating any knowledge barrier. The PR:L (subscriber-level) requirement is the only meaningful gating condition, and subscriber accounts are freely registrable on the majority of WordPress sites. No EPSS data was provided and this CVE is not listed in CISA KEV, meaning no confirmed widespread active exploitation at time of analysis - however, the attack path is straightforward enough that the absence from KEV should not reduce urgency on sites with open registration. The 'Limited' qualifier in the vulnerability name suggests the extension filter blocks some obvious types (e.g., .php), meaning an attacker must use a bypass technique such as .php5, .phtml, or double extensions - this adds minor friction but does not prevent exploitation on misconfigured or default servers. RCE impact is additionally contingent on the web server executing files in the plugin upload directory; if PHP execution is restricted there, impact downgrades to unauthorized file write.

An attacker registers a free subscriber account on the target WordPress site, then visits the front-end location editor page to extract the nonce value from the CMLOC_Editor_Images JavaScript object in the page source. The attacker sends a crafted multipart HTTP POST to the uploadMedia endpoint with a file named using an extension bypass (e.g., shell.php5 or shell.phtml) to evade the incomplete extension filter; if the server is configured to execute such files in the upload directory, requesting the uploaded file's URL triggers remote code execution under the web server process identity.