What is the CVSS score of EUVD-2026-46168?

EUVD-2026-46168 has a CVSS 3.1 base score of 7.2 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.6%.

Which versions of Wordpress Plugin are affected by EUVD-2026-46168?

The MapSVG WordPress plugin (versions 8.14.0 and earlier) contains a file upload vulnerability that bypasses validation controls and enables potential remote code execution.

How to fix or mitigate EUVD-2026-46168?

Within 24 hours, identify all WordPress installations running MapSVG versions 8.14.0 or earlier; disable the plugin on systems where it is not actively required. Within 7 days, audit WordPress administrator-level user accounts and access controls, implement principle-of-least-privilege access, and enable multi-factor authentication for admin accounts; deploy file integrity monitoring on upload directories. Within 30 days, establish monitoring of the MapSVG plugin repository and Wordfence security advisories for vendor patches; once a patched version is released, test and deploy immediately to all affected production systems within your change management process.

Wordpress Plugin EUVD-2026-46168

| CVE-2026-1771 HIGH

Improper Input Validation (CWE-20)

2026-07-21 Wordfence

GHSA-2h4g-724w-gfcv

WordPress RCE Wordpress Plugin Mapsvg Vector Maps Image Maps Google Maps

7.2

CVSS 3.1 · Vendor: Wordfence

Severity by source

Vendor (Wordfence) PRIMARY

7.2 HIGH

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Primary rating from Vendor (Wordfence) · only source for this CVE.

CVSS VectorVendor: Wordfence

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 21, 2026 - 08:46 vuln.today

CVE Published

Jul 21, 2026 - 07:51 cve.org

HIGH 7.2

DescriptionCVE.org

The MapSVG plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the SVGFile constructor in all versions up to, and including, 8.14.0 This is due to an incorrect conditional check that prevents file validation from taking place. This makes it possible for authenticated attackers, with Administrator-level access and above, to upload arbitrary files on the affected site's server which may make remote code execution possible.

AnalysisAI

Arbitrary file upload in the MapSVG WordPress plugin (all versions through 8.14.0) lets authenticated Administrator-level users bypass file-type validation in the SVGFile constructor and upload arbitrary files, potentially achieving remote code execution on the host. The flaw stems from an incorrect conditional that skips validation entirely rather than enforcing it. Reported by Wordfence with a CVSS 3.1 base score of 7.2; no public exploit identified at time of analysis and it is not listed in CISA KEV.