CVE-2026-65455 CRITICAL

CVE-2026-65455: WordPress MapSVG plugin <= 8.14.0 - Arbitrary File Upload vulnerability

Vendor Mapsvg
Product MapSVG
Weakness CWE-434 · Unrestricted file upload
Published July 23, 2026
Last update July 23, 2026
View on NVD All CVEs

CVSS base score

9.1/10
Attack vector Network
Attack complexity Low
Privileges required High
User interaction None
Confidentiality High
Integrity High

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

What the vulnerability does

01Description

Administrator Arbitrary File Upload in MapSVG <= 8.14.0 versions.

Explanation of Vulnerability in Simple Terms

02Summary

MapSVG versions up to 8.14.0 contain an unrestricted file upload vulnerability. An authenticated administrator can upload files without proper validation, potentially allowing them to upload malicious files to the server. This could lead to unauthorized access, data theft, or site compromise. Update to a version newer than 8.14.0 to resolve this issue.

What an attacker can do

03Attacker Capabilities

Upload arbitrary files to the server and execute malicious code.

Potential impact on your site

04Site Impact

An admin account compromise could allow file uploads leading to full site takeover or data breach.

Conditions required to exploit

05Prerequisites

Attacker must have administrator-level access to MapSVG.

Key dates

06Disclosure timeline

July 23, 2026 CVE published
July 23, 2026 Record updated

Related vulnerabilities

08Related CVE

CVE-2026-4885 Piotnet Addons for Elementor Pro <= 7.1.70 - Unauthenticated Arbitrary File Upload via Form File Upload CVE-2026-2942 ProSolution WP Client <= 1.9.9 - Unauthenticated Arbitrary File Upload via proSol_fileUploadProcess CVE-2026-27067 WordPress Mobile App Editor plugin <= 1.3.1 - Arbitrary File Upload vulnerability CVE-2026-32523 WordPress WPJAM Basic plugin <= 6.9.2 - Arbitrary File Upload vulnerability CVE-2026-27419 WordPress Zegen theme <= 1.1.9 - Arbitrary File Upload vulnerability