CVE-2026-111406
9.9CriticalPublished 19 Oct 2026 · NVD status: Received · AI triage by gemini-3.8-flash
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- Low
- User interaction
- None
- Impact
- Full C/I/A compromise
- Weakness
- CWE-434
Impact
Authenticated attackers with low-privilege access can upload a web shell to achieve remote code execution on the web server. They only need basic user access to the WordPress site to trigger the file upload.
Root cause
The plugin fails to restrict file types during upload, allowing executable script files like PHP to be saved directly to the server.
Affected systems
MapSVG (mapsvg-lite-interactive-vector-maps) through 8.16.1
CVSS v3.1 · CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Fix & remediation
Upgrade to a version newer than 8.16.1 once released by the vendor, or immediately deactivate and uninstall the MapSVG plugin until a patched version is available.
$ wp plugin deactivate mapsvg-lite-interactive-vector-mapsAI-suggested. Run it in staging first and check it against the vendor advisory. Why?
NVD description
Unrestricted Upload of File with Dangerous Type vulnerability in PT Norther Lights Production MapSVG mapsvg-lite-interactive-vector-maps allows Upload a Web Shell to a Web Server.This issue affects MapSVG: from n/a through 8.16.1.