The CVE-2025-47559 vulnerability permits attackers to upload arbitrary files of dangerous types, such as PHP files, to a WordPress site running the MapSVG plugin before version 8.7.4. By uploading a web shell, an attacker could gain unrestricted code execution on the web server, potentially exfiltrating data, installing back‑doors, or pivoting to other systems. The weakness is identified as CWE‑434.

The affected product is the WordPress MapSVG plugin developed by RomanCode, versions earlier than 8.7.4. This includes all releases from the first available version up to 8.7.3. Users running a WordPress site with this plugin installed and not yet upgraded are at risk.

The CVSS score of 9.9 indicates critical severity. The EPSS score of less than 1% suggests a low current exploitation probability, but the existence in the public domain and the simplicity of the exploit elevate the risk. The KEV status is not listed. Attackers can exploit this weakness through normal user‑facing file upload interfaces; no special privileges are required, so the attack is trivial if the site allows anonymous uploads or the user has upload permissions. Once a malicious file is placed on the server, the attacker can execute it to take control of the server.