ByteOS Network

CVE Vulnerability Details :

CVE-2026-1771

PUBLISHED

More Info Official Page

Assigner-Wordfence

Assigner Org ID-b15e7b5b-3da4-40ae-a43c-f7aa60e62599

Published At-21 Jul, 2026 | 07:51

Updated At-22 Jul, 2026 | 13:59

▼CVE Numbering Authority (CNA)

MapSVG <= 8.14.0 - Authenticated (Administrator+) Arbitrary File Upload via '/mapsvg/v1/svgfile' Endpoint

The MapSVG plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the SVGFile constructor in all versions up to, and including, 8.14.0 This is due to an incorrect conditional check that prevents file validation from taking place. This makes it possible for authenticated attackers, with Administrator-level access and above, to upload arbitrary files on the affected site's server which may make remote code execution possible.

Affected Products

Vendor

oyatek

Product

MapSVG – Vector maps, Image maps, Google Maps

Default Status

unaffected

Versions

Affected

From 0 through 8.14.0 (semver)

Problem Types

Type	CWE ID	Description
CWE	CWE-20	CWE-20 Improper Input Validation

Type: CWE

CWE ID: CWE-20

Description: CWE-20 Improper Input Validation

Metrics

Version	Base score	Base severity	Vector
3.1	7.2	HIGH	CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Version: 3.1

Base score: 7.2

Base severity: HIGH

Vector:

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Credits

finder

san6051

Timeline

Event	Date
Vendor Notified	2026-02-02 16:30:52
Disclosed	2026-07-20 19:29:00

Event: Vendor Notified

Date: 2026-02-02 16:30:52

Event: Disclosed

Date: 2026-07-20 19:29:00

References

Hyperlink	Resource
https://www.wordfence.com/threat-intel/vulnerabilities/id/c7f098b9-eca3-41c7-9c74-0f4b3f75c915?source=cve	N/A
https://plugins.trac.wordpress.org/browser/mapsvg-lite-interactive-vector-maps/trunk/php/Domain/SVGFile/SVGFile.php#L24	N/A
https://plugins.trac.wordpress.org/browser/mapsvg-lite-interactive-vector-maps/tags/8.9.1/php/Domain/SVGFile/SVGFile.php#L24	N/A
https://plugins.trac.wordpress.org/browser/mapsvg-lite-interactive-vector-maps/tags/8.9.1/php/Router.php#L641	N/A
https://plugins.trac.wordpress.org/browser/mapsvg-lite-interactive-vector-maps/tags/8.9.1/php/Domain/File/FilesRepository.php#L166	N/A
https://plugins.trac.wordpress.org/changeset/3608308/mapsvg-lite-interactive-vector-maps/trunk/php/Domain/SVGFile/SVGFile.php	N/A
https://plugins.trac.wordpress.org/changeset?old_path=%2Fmapsvg-lite-interactive-vector-maps/tags/8.14.0&new_path=%2Fmapsvg-lite-interactive-vector-maps/tags/8.14.1	N/A