Unrestricted upload of files of dangerous types in the RomanCode MapSVG plugin enables an attacker to place a web shell on the host web server. The vulnerability is a clear case of insecure file upload (CWE‑434), allowing arbitrary code execution once the malicious file is stored and subsequently accessed through the server. Successful exploitation would compromise confidentiality, integrity, and availability of the underlying WordPress site.

All installations of the RomanCode MapSVG plugin with version 8.7.3 or earlier on WordPress sites are affected. The issue applies whenever the upload functionality of the plugin is enabled, regardless of specific WordPress configuration or other plugins.

The CVSS score of 9.9 marks this vulnerability as critical, while the EPSS score of less than 1% indicates a very low probability of exploitation in the wild to date. The plugin is not listed in the CISA KEV catalog, suggesting no widespread documented exploitation. The likely attack path is through the web interface that processes file uploads; an attacker can upload an arbitrary file of any type, bypassing type checks, and later invoke it to execute code on the server.