What is the CVSS score of CVE-2026-65455?

CVE-2026-65455 has a CVSS 3.1 base score of 9.1 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H. EPSS exploitation probability: 0.4%.

Which versions of MapSVG are affected by CVE-2026-65455?

MapSVG WordPress plugin versions 8.14.0 and earlier contain a file upload vulnerability enabling authenticated administrators to execute arbitrary code on the web server.

How to fix or mitigate CVE-2026-65455?

Within 24 hours, audit all WordPress installations to identify MapSVG plugin versions 8.14.0 and earlier and document which administrative users have access to plugin settings. Within 7 days, implement mitigations: disable the file upload feature if not actively required, restrict uploads to image-only file types in plugin configuration, enforce MFA for all administrative accounts with plugin access, and deploy WAF rules to block executable file uploads to plugin directories. Within 30 days, monitor vendor advisories for patch availability and prepare migration to alternative plugins if no patch is released.

MapSVG CVE-2026-65455

EUVD-2026-48220 CRITICAL

Unrestricted Upload of File with Dangerous Type (CWE-434)

2026-07-23 Patchstack

GHSA-wqmx-26v8-w3xg

WordPress File Upload Wordpress Plugin Mapsvg

9.1

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

9.1 CRITICAL

AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

vuln.today AI

7.2 HIGH

Admin-only upload keeps PR:H and AC:L over the network; I assess S:U rather than S:C because code executes within the same WordPress/web-server security authority, with full C/I/A impact from resulting RCE.

3.1 AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 23, 2026 - 12:36 vuln.today

CVE Published

Jul 23, 2026 - 11:18 cve.org

CRITICAL 9.1

DescriptionCVE.org

Administrator Arbitrary File Upload in MapSVG <= 8.14.0 versions.

AnalysisAI

Arbitrary file upload in the MapSVG WordPress plugin (versions 8.14.0 and earlier) allows an authenticated administrator to upload files of unrestricted type, enabling execution of attacker-supplied code (e.g. a PHP webshell) on the hosting server. Reported by Patchstack and classified as CWE-434, the flaw carries a CVSS 9.1 owing to a scope change, but the PR:H requirement means only accounts already holding administrator privileges can trigger it. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.

Technical ContextAI

MapSVG is a WordPress plugin (distributed as 'MapSVG Lite - Interactive Vector Maps' and a paid edition) used to render interactive SVG/vector maps and manage associated map data, images, and markers. The vulnerability is an unrestricted upload of a file with a dangerous type (CWE-434): an upload handler exposed to administrative users fails to validate or restrict the file extension/MIME type, so a script-executable file (such as .php) can be written into a web-accessible path. Because WordPress plugins run inside the PHP application context, a file that lands in the web root and is subsequently requested is executed by the server, converting a data-upload feature into arbitrary code execution. The affected CPE is cpe:2.3:a:mapsvg:mapsvg:*:*:*:*:*:*:*:*.

RemediationAI

Upgrade MapSVG to a release later than 8.14.0 once the vendor publishes it; No vendor-released patch identified at time of analysis, so consult the Patchstack advisory (https://patchstack.com/database/wordpress/plugin/mapsvg-lite-interactive-vector-maps/vulnerability/wordpress-mapsvg-plugin-8-14-0-arbitrary-file-upload-vulnerability?_s_id=cve) for the corrected version before deploying. Until a fixed version is confirmed, compensating controls include: restrict the administrator role to trusted, MFA-protected accounts and audit existing admin users to reduce the pool that can trigger the upload; deploy a WAF or Patchstack virtual patch to block the plugin's upload endpoint; and configure the web server to deny PHP execution within the plugin's/WordPress uploads directories (e.g. an Nginx location or Apache <Directory> rule disabling the PHP handler) - the trade-off is that legitimately uploaded map assets remain served as static files but any planted script will not execute. Consider deactivating the plugin if interactive maps are non-essential.