Description
Incorrect Privilege Assignment vulnerability in RomanCode MapSVG mapsvg allows Privilege Escalation.This issue affects MapSVG: from n/a through < 8.6.13.
Published: 2025-06-09
Score: 8.8 High
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

An incorrect assignment of privileges in RomanCode's MapSVG plugin permits an attacker to increase their privileges within a WordPress installation. The flaw is classified as CWE-266 and allows an individual to gain higher authority, potentially enabling unauthorized configuration changes, content manipulation, or other actions reserved for administrators.

Affected Systems

The RomanCode MapSVG plugin, versions prior to 8.6.13, are affected. Any WordPress site running MapSVG 8.6.12 or earlier may be vulnerable.

Risk and Exploitability

The CVSS score of 8.8 indicates a high severity vulnerability. With an EPSS score of less than 1% the likelihood of exploitation is currently low, and the flaw is not listed in CISA's KEV catalog. No specific attack vector is provided in the advisory; it is inferred that the vulnerability may be triggered via authenticated access or by manipulating privileged endpoints within the plugin. The impact is limited to WordPress environments that host the affected MapSVG plugin.

Generated by OpenCVE AI on April 30, 2026 at 11:34 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade RomanCode MapSVG to version 8.6.13 or later.
  • If an immediate upgrade is not possible, limit access to the plugin's configuration pages and enforce the principle of least privilege for all WordPress users.
  • Monitor user activity for suspicious changes and verify that only authorized administrators have capability to modify plugin settings.

Generated by OpenCVE AI on April 30, 2026 at 11:34 UTC.

Tracking

Sign in to view the affected projects.

Advisories
Source ID Title
EUVD EUVD EUVD-2025-17520 Incorrect Privilege Assignment vulnerability in PT Norther Lights Production MapSVG allows Privilege Escalation.This issue affects MapSVG: from n/a before 8.6.13.
History

Thu, 23 Apr 2026 15:00:00 +0000

Type Values Removed Values Added
Metrics cvssV3_1

{'score': 8.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'}

Wed, 01 Apr 2026 23:45:00 +0000

Type Values Removed Values Added
Description Incorrect Privilege Assignment vulnerability in PT Norther Lights Production MapSVG allows Privilege Escalation.This issue affects MapSVG: from n/a before 8.6.13. Incorrect Privilege Assignment vulnerability in RomanCode MapSVG mapsvg allows Privilege Escalation.This issue affects MapSVG: from n/a through < 8.6.13.
References
Metrics cvssV3_1

{'score': 8.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'}

Fri, 11 Jul 2025 13:45:00 +0000

Type Values Removed Values Added
Metrics epss

{'score': 0.00044}

 epss

{'score': 0.0005}

Thu, 03 Jul 2025 10:15:00 +0000

Type Values Removed Values Added
Description Incorrect Privilege Assignment vulnerability in RomanCode MapSVG allows Privilege Escalation. This issue affects MapSVG: from n/a through 8.5.34. Incorrect Privilege Assignment vulnerability in PT Norther Lights Production MapSVG allows Privilege Escalation.This issue affects MapSVG: from n/a before 8.6.13.
Title WordPress MapSVG <= 8.5.34 - Privilege Escalation Vulnerability WordPress MapSVG plugin < 8.6.13 - Privilege Escalation Vulnerability

Mon, 09 Jun 2025 18:15:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Mon, 09 Jun 2025 16:00:00 +0000

Type Values Removed Values Added
Description Incorrect Privilege Assignment vulnerability in RomanCode MapSVG allows Privilege Escalation. This issue affects MapSVG: from n/a through 8.5.34.
Title WordPress MapSVG <= 8.5.34 - Privilege Escalation Vulnerability
Weaknesses CWE-266
References
Metrics cvssV3_1

{'score': 8.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'}

Subscriptions

No data.

cve-icon MITRE

Status: PUBLISHED

Assigner: Patchstack

Published:

Updated: 2026-05-12T00:22:29.980Z

Reserved: 2025-05-07T09:40:07.681Z

Link: CVE-2025-47561

cve-icon Vulnrichment

Updated: 2025-06-09T17:17:47.638Z

cve-icon NVD

Status : Deferred

Published: 2025-06-09T16:15:41.700

Modified: 2026-04-23T15:30:29.423

Link: CVE-2025-47561

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-04-30T11:45:21Z

Weaknesses