The CM Map Locations WordPress plugin allows authenticated users with subscriber-level access to upload files through an AJAX action that performs inadequate file type validation. The upload handler only checks file extensions and omits MIME‑type verification or capability checks before writing the file, enabling attackers to upload executable files that can be executed on the server.」

Any WordPress installation that has the CM Map Locations plugin version 2.1.8 or earlier deployed. The vulnerability applies to all sites where users can log in as subscribers or higher and access the location editor page, since the nonce needed to call the upload handler is exposed in a JavaScript object on that page.

With a CVSS score of 8.8 the vulnerability is considered high severity. No EPSS score is available, and the issue is not listed in the CISA KEV catalog. The attack vector requires an authenticated subscriber or higher to log in and use the front‑end location editor; the attacker can then supply a malicious file to the upload endpoint, leading to remote code execution. Given the lack of an EPSS score, exploitation probability is uncertain but the existence of the flaw and its high severity warrant prompt action.