An unrestricted file upload flaw in the MapSVG plugin allows an attacker to deposit a malicious file, such as a web shell, onto the hosting server. Because the plugin does not restrict file types, an adversary can place executable code that the server may run, leading to full compromise of the affected site. This capability delivers severe confidentiality, integrity, and availability risks, reflected in the CVSS score of 9.9.

The vulnerability affects the PT Norther Lights Production MapSVG plugin (mapsvg-lite-interactive-vector-maps) up to and including version 8.16.1. Any WordPress installation using this plugin in those versions is at risk if the upgrade has not been applied.

The flaw is rated high severity (CVSS 9.9) and currently has no EPSS score available, indicating insufficient data on recent exploit activity. It is not listed in the CISA KEV catalog. The likely attack vector is via the plugin’s upload interface, and exploitation requires access to that interface. Due to the absence of mitigations in the vulnerable versions, a successful upload can lead to arbitrary code execution on the server, making this a critical threat if the plugin remains unpatched.