CVE-2026-111398
7.7HighPublished 19 Oct 2026 · NVD status: Received · AI triage by gemini-3.8-flash
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- Low
- User interaction
- None
- Impact
- High impact on availability
- Weakness
- CWE-22
Impact
Authenticated attackers can cause a denial of service by deleting arbitrary files on the WordPress server. They only need low-privilege network access to an account on the affected site.
Root cause
Improper limitation of a pathname enables a path traversal vulnerability that permits unauthorized file deletion.
Affected systems
PT Northern Lights Production MapSVG (mapsvg-lite-interactive-vector-maps) through 8.16.1
CVSS v3.1 · CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H
Fix & remediation
Upgrade to a version newer than 8.16.1 if available; otherwise, deactivate and uninstall the MapSVG plugin until a patched release is published.
$ wp plugin deactivate mapsvg-lite-interactive-vector-mapsAI-suggested. Run it in staging first and check it against the vendor advisory. Why?
NVD description
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in PT Norther Lights Production MapSVG mapsvg-lite-interactive-vector-maps allows Path Traversal.This issue affects MapSVG: from n/a through 8.16.1.