MapSVG WordPress plugin: Unrestricted file upload allows web shell
Summary
The MapSVG WordPress plugin (slug mapsvg-lite-interactive-vector-maps) up to version 8.16.1 does not restrict the type of uploaded files. An attacker who can reach the upload function can place a web shell on the web server and take over the site. Patchstack describes the required access as Contributor level, but the exact privilege requirement is not confirmed by the CVE record.
Affected
- MapSVG (WordPress plugin, slug mapsvg-lite-interactive-vector-maps) through 8.16.1
- NVD and CNA data list all versions up to and including 8.16.1
Fixed in
- Version 8.16.2 (according to the Patchstack advisory and the CNA solution)
- Vendor changelog for this CVE: Unknown.
Workaround
Unknown. No vendor-sourced workaround was found.
Exploitation
- CISA SSVC (Vulnrichment): exploitation none, automatable no, technical impact total
- Patchstack rates it as medium priority and expects exploitation, and it has issued a mitigation rule.
- Not listed as known exploited. No public proof of concept found.
- The CVSS base score differs: CNA 9.9 (CRITICAL), VulDB 6.3 (Medium).
Our recommendation
- Inventory all WordPress sites and check whether MapSVG is installed and which version it runs.
- Update MapSVG to version 8.16.2 or later and verify the installed version.
- Review user accounts with Contributor or higher roles and remove unneeded accounts.
- Check wp-content/uploads for unexpected PHP or other executable files and review recent uploads.
- Deactivate the plugin if it is not essential.
- Block PHP execution in upload directories.
- Monitor the Patchstack advisory and NVD, as the NVD status is Deferred.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Patchstack advisory: MapSVG arbitrary file upload patchstack.com
- WordPress.org plugin page: MapSVG wordpress.org
- WPScan: MapSVG plugin vulnerabilities wpscan.com
- VulDB entry 422302 vuldb.com
- OpenCVE: CVE-2026-111406 app.opencve.io
- HOL Guard: CVE-2026-111406 hol.org
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 30 Oct 2026, 15:14.
Original description (NVD)
Unrestricted Upload of File with Dangerous Type vulnerability in PT Norther Lights Production MapSVG mapsvg-lite-interactive-vector-maps allows Upload a Web Shell to a Web Server.This issue affects MapSVG: from n/a through 8.16.1.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.