Quick answers
- Is CVE-2026-82852 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-82852 being exploited in the wild.
- How severe is CVE-2026-82852?
- Medium severity, with a CVSS score of 5.4, published 31 August 2026.
- Which products and versions are affected?
- PT Norther Lights Production MapSVG <= 8.15.0.
- Is there a fix for CVE-2026-82852?
- A patch was published on 2026-08-31: Patched in version 8.16.0 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2026-82852 attacked?
- It is attacked over the network.
- Am I affected by CVE-2026-82852?
- Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
This is a Server Side Request Forgery (SSRF) vulnerability in the MapSVG WordPress plugin versions up to 8.15.0. The vulnerability is unauthenticated, meaning no user login is required to exploit it. An attacker can craft malicious requests that cause the server to make connections to internal systems or services, bypassing network-based access controls and potentially exposing sensitive data or internal infrastructure. The vulnerability has been patched in version 8.16.0 and later.
Affected products
- PT Norther Lights Production MapSVG <= 8.15.0
Timeline
- 2026-08-31: disclosed: Vulnerability published on NVD and Patchstack
- 2026-08-31: patched: Patched in version 8.16.0
- 2026-07-21: other: Reported by Adam Kahlon (Adkali)