MapSVG – Vector maps, Image maps, Google Maps <= 8.16.1 - Authenticated (Contributor+) Arbitrary File Deletion via Import Preflight File Path
- ID
- WPSEC-2026-1163
- Plugin
- MapSVG – Vector maps, Image maps, Google Maps (mapsvg-lite-interactive-vector-maps)
- Affected
- from 8.13.0 before 8.16.2
- Remediation
- Update to 8.16.2 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H
- Weakness
- CWE-22
- Usage
- Plugin Low · Affected versions None seen among sites WPSec scans, 2026-10-16
- Attack surface
- MapSVG – Vector maps, Image maps, Google Maps on WPSec AttackSurface
- Fix released
- Published
Description
The MapSVG plugin for WordPress is vulnerable to arbitrary file deletion via the import preflight file path in all versions up to, and including, 8.16.1. The import_settings record can be written through the generic collection REST routes, which only require the edit_posts capability, and the stored preflight file path is passed to unlink() without checking where it points when expired preflight data is cleared. This makes it possible for authenticated attackers, with Contributor-level access and above, to delete arbitrary files on the server, which can easily lead to remote code execution when the right file (such as wp-config.php) is deleted.
References
- https://wpsec.com/vuln/WPSEC-2026-1163/
- https://plugins.svn.wordpress.org/mapsvg-lite-interactive-vector-maps/tags/8.16.2/
- https://wordpress.org/plugins/mapsvg-lite-interactive-vector-maps/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS