The OS DataHub Maps WordPress plugin suffers from incorrect file type validation in the function OS_DataHub_Maps_Admin::add_file_and_ext. This flaw allows an authenticated user with Author-level or higher access to upload any file type to the site’s server. Once an attacker can place malicious files, they may achieve remote code execution by uploading a script or other exploitative payload. The flaw is identified as CWE‑434, which represents improper validation of file type or extension.

This vulnerability affects the OS DataHub Maps plugin from skirridsystems, available in all WordPress installations up to and including version 1.8.3. Users who have installed any of these versions and have Author or higher role permissions are at risk.

The vulnerability carries a CVSS score of 8.8, indicating a high severity potential for remote code execution. The EPSS score is less than 1%, suggesting that, while the flaw is serious, it is currently unlikely to be widely exploited. The vulnerability is not listed in the CISA KEV catalog. Exploitation requires legitimate access with Author-level privileges, making it a credentialed attack; thus, the primary risk lies with internal users who have sufficient permissions.