{
 "id": "WPSEC-2026-1163",
 "url": "https://wpsec.com/vuln/WPSEC-2026-1163/",
 "json_url": "https://wpsec.com/vuln/WPSEC-2026-1163/advisory.json",
 "markdown_url": "https://wpsec.com/vuln/WPSEC-2026-1163/index.md",
 "title": "MapSVG – Vector maps, Image maps, Google Maps <= 8.16.1 - Authenticated (Contributor+) Arbitrary File Deletion via Import Preflight File Path",
 "description": "The MapSVG plugin for WordPress is vulnerable to arbitrary file deletion via the import preflight file path in all versions up to, and including, 8.16.1. The import_settings record can be written through the generic collection REST routes, which only require the edit_posts capability, and the stored preflight file path is passed to unlink() without checking where it points when expired preflight data is cleared. This makes it possible for authenticated attackers, with Contributor-level access and above, to delete arbitrary files on the server, which can easily lead to remote code execution when the right file (such as wp-config.php) is deleted.",
 "plugin": {
  "slug": "mapsvg-lite-interactive-vector-maps",
  "name": "MapSVG – Vector maps, Image maps, Google Maps",
  "full_name": "MapSVG – Vector maps, Image maps, Google Maps",
  "wordpress_org": "https://wordpress.org/plugins/mapsvg-lite-interactive-vector-maps/",
  "advisories_url": "https://wpsec.com/vuln/plugin/mapsvg-lite-interactive-vector-maps/",
  "attacksurface": "https://attacksurface.wpsec.com/plugin/mapsvg-lite-interactive-vector-maps"
 },
 "type": "FILE DELETION",
 "cwe": [
  "CWE-22"
 ],
 "cve": [],
 "cvss": {
  "version": "3.1",
  "score": 8.1,
  "vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H",
  "severity": "High"
 },
 "affected": {
  "ranges": [
   {
    "from": "8.13.0",
    "from_inclusive": true,
    "to": "8.16.2",
    "to_inclusive": false
   }
  ],
  "text": [
   "from 8.13.0 before 8.16.2"
  ]
 },
 "introduced_in": "8.13.0",
 "fixed_in": "8.16.2",
 "remediation": "Update to 8.16.2 or later.",
 "fix_released": "2026-10-16T05:12:27+00:00",
 "published": "2026-10-17T05:42:11+00:00",
 "updated": "2026-10-16T09:50:39.472867+00:00",
 "also_published_as": null,
 "references": [
  "https://wpsec.com/vuln/WPSEC-2026-1163/",
  "https://plugins.svn.wordpress.org/mapsvg-lite-interactive-vector-maps/tags/8.16.2/",
  "https://wordpress.org/plugins/mapsvg-lite-interactive-vector-maps/"
 ],
 "attacksurface_url": "https://attacksurface.wpsec.com/plugin/mapsvg-lite-interactive-vector-maps",
 "source": "WPSec",
 "license": {
  "name": "CC BY 4.0",
  "url": "https://creativecommons.org/licenses/by/4.0/"
 },
 "usage": {
  "plugin": "Low",
  "affected_versions": "None seen",
  "as_of": "2026-10-17"
 }
}