An attacker can upload a file of any type to the WordPress site through the MapSVG Lite plugin. The plugin performs no validation and allows a malicious web shell to be stored on the server. An uploaded shell can be executed on the web server, granting the attacker complete control over the compromised site. This vulnerability qualifies as a remote code execution flaw (CWE-434) and can lead to full compromise of the affected WordPress installation.

Organizations using RomanCode's MapSVG Lite plugin for WordPress, any version up to and including 8.6.4, are affected. No specific version range beyond the maximum is listed, so all releases from the plugin’s initial release through 8.6.4 are vulnerable. The issue is tied to the mapsvg-lite-interactive-vector-maps component of the MapSVG suite.

The CVSS score of 9.9 signals maximum severity. The EPSS score indicates a very low but non-zero exploitation probability at present. The vulnerability is not yet cataloged in the CISA KEV list, suggesting it has not been widely observed in the wild. In practice, an attacker could exploit this flaw by simply uploading a crafted file via the plugin’s public interface, assuming the site has the vulnerable version and the attacker can access the file upload functionality. Once the file resides on the server, execution is achieved if the file is reachable by the web server, a common scenario for web shells.