The vulnerability resides in the MapSVG plugin for WordPress, identified as an arbitrary file upload flaw caused by missing file type validation in the SVGFile constructor. The flawed conditional check allows authenticated users with Administrator level access to upload any file type via the '/mapsvg/v1/svgfile' endpoint. Because the uploaded files are stored on the server without restriction, attackers could place malicious scripts, leading to remote code execution if the uploaded file is executed.

Affected systems include all installations of the oyatek MapSVG plugin, specifically versions up to and including 8.14.0. This encompasses releases such as 8.9.1 and 8.14.0. WordPress sites deploying these versions are vulnerable if the plugin is active and the endpoint is accessible to any administrator or higher‑level account.

The CVSS score of 7.2 classifies the issue as high severity, while the EPSS score of less than 1% indicates a very low but non‑zero probability of exploitation. The vulnerability is not listed in CISA's KEV catalog. Due to the necessity of administrator privileges for exploitation, the attack vector is likely through compromised or malicious admin accounts; however, no direct exploitation path for unauthenticated users is disclosed. Once the flaw is exploited, remote code execution and full site compromise become possible.