# MapSVG – Vector maps, Image maps, Google Maps <= 8.16.1 - Authenticated (Contributor+) Arbitrary File Deletion via Import Preflight File Path

- **ID:** WPSEC-2026-1163
- **Plugin:** MapSVG – Vector maps, Image maps, Google Maps (`mapsvg-lite-interactive-vector-maps`), https://wordpress.org/plugins/mapsvg-lite-interactive-vector-maps/
- **Affected versions:** from 8.13.0 before 8.16.2
- **Fixed in:** 8.16.2 (Update to 8.16.2 or later.)
- **Severity:** High 8.1 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H)
- **Weakness:** CWE-22
- **Usage among sites WPSec scans:** plugin Low, affected versions None seen (as of 2026-10-17)
- **Attack surface analysis:** https://attacksurface.wpsec.com/plugin/mapsvg-lite-interactive-vector-maps
- **Fix released:** 2026-10-16
- **Published:** 2026-10-17
- **URL:** https://wpsec.com/vuln/WPSEC-2026-1163/

## Description

The MapSVG plugin for WordPress is vulnerable to arbitrary file deletion via the import preflight file path in all versions up to, and including, 8.16.1. The import_settings record can be written through the generic collection REST routes, which only require the edit_posts capability, and the stored preflight file path is passed to unlink() without checking where it points when expired preflight data is cleared. This makes it possible for authenticated attackers, with Contributor-level access and above, to delete arbitrary files on the server, which can easily lead to remote code execution when the right file (such as wp-config.php) is deleted.

## References

- https://wpsec.com/vuln/WPSEC-2026-1163/
- https://plugins.svn.wordpress.org/mapsvg-lite-interactive-vector-maps/tags/8.16.2/
- https://wordpress.org/plugins/mapsvg-lite-interactive-vector-maps/

Source: WPSec, https://wpsec.com/vuln/WPSEC-2026-1163/

License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Free to use, share and adapt, also commercially, if you credit WPSec and link to this advisory.