Executive brief
The CM Map Locations WordPress plugin allows users to create and share location-based maps on their websites. The plugin's file upload feature fails to properly validate file types, allowing authenticated users with basic subscriber accounts to upload and execute arbitrary files on the server. An attacker with minimal access could exploit this to run malicious code and compromise the entire website and potentially steal or modify customer data.
Technical details
The plugin's uploadMedia function in the file upload handler performs incomplete extension-based filtering without MIME-type validation or upload capability verification before invoking move_uploaded_file(). The vulnerability requires authentication (subscriber-level or above), but the security nonce is exposed to all logged-in subscribers via the CMLOC_Editor_Images JavaScript object on the front-end location editor page, reducing the barrier to exploitation. An attacker can bypass file type restrictions and upload executable files (e.g., PHP shells) to achieve remote code execution on the web server. The vulnerability affects all versions up to and including 2.1.8; patched versions or mitigations are not mentioned in the advisory.
Affected products
- CM Map Locations CM Map Locations up to and including 2.1.8
Timeline
- 2026-08-25: disclosed