# CVE-2026-65455: MapSVG arbitrary file upload in WordPress plugin

Source: https://junglewise.ai/threats/cve-2026-65455-mapsvg-arbitrary-file-upload-in-wordpress-plugin  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-07-23. Updated: 2026-07-23  
License: CC BY 4.0 with a link back

CVE-2026-65455 · Severity: critical · CVSS 9.1 · Published 2026-07-23

MapSVG is a WordPress plugin used to create interactive vector maps. A security vulnerability allows an administrative user to upload malicious files, such as web shells, directly to the server. This could lead to a complete takeover of the website and the underlying server infrastructure.

## Quick answers

**Is CVE-2026-65455 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-65455 being exploited in the wild.

**How severe is CVE-2026-65455?** Critical severity, with a CVSS score of 9.1, published 23 July 2026.

**Which products and versions are affected?** MapSVG MapSVG <= 8.14.0.

**Is there a fix for CVE-2026-65455?** A patch was published on 2026-07-23: Version 8.14.1 released to address the issue Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-65455 attacked?** It is attacked over the network, in a network appliance.

**Am I affected by CVE-2026-65455?** Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The MapSVG plugin for WordPress (versions <= 8.14.0) contains an unrestricted file upload vulnerability (CWE-434). The flaw allows an authenticated user with Administrator privileges to upload dangerous file types, such as PHP scripts, to the web server. Because the plugin fails to properly validate file extensions or content, an attacker can achieve remote code execution (RCE) and potentially escape the WordPress environment to the host system. The vulnerability is addressed in version 8.14.1.

## Affected products

- MapSVG MapSVG <= 8.14.0

## Timeline

- 2026-04-29: other: Reported by Securepeak Research Team
- 2026-07-22: advisory: Patchstack advisory published
- 2026-07-23: disclosed: NVD publication date
- 2026-07-23: patched: Version 8.14.1 released to address the issue

## References

- [https://patchstack.com/database/wordpress/plugin/mapsvg-lite-interactive-vector-maps/vulnerability/wordpress-mapsvg-plugin-8-14-0-arbitrary-file-upload-vulnerability?_s_id=cve](https://patchstack.com/database/wordpress/plugin/mapsvg-lite-interactive-vector-maps/vulnerability/wordpress-mapsvg-plugin-8-14-0-arbitrary-file-upload-vulnerability?_s_id=cve)