Logo
Retour à la veille

CVE-2026-1771

Publié : 21 juillet 2026
Modifié : 21 juillet 2026
Lien officiel NVD
Score CVSS
7.2
HIGH

Description détaillée

The MapSVG plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the SVGFile constructor in all versions up to, and including, 8.14.0 This is due to an incorrect conditional check that prevents file validation from taking place. This makes it possible for authenticated attackers, with Administrator-level access and above, to upload arbitrary files on the affected site's server which may make remote code execution possible.

Vecteur d'attaque (CVSS)

Vecteur brut :CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Références et Patchs

https://plugins.trac.wordpress.org/browser/mapsvg-lite-interactive-vector-maps/tags/8.9.1/php/Domain/File/FilesRepository.php#L166https://plugins.trac.wordpress.org/browser/mapsvg-lite-interactive-vector-maps/tags/8.9.1/php/Domain/SVGFile/SVGFile.php#L24https://plugins.trac.wordpress.org/browser/mapsvg-lite-interactive-vector-maps/tags/8.9.1/php/Router.php#L641https://plugins.trac.wordpress.org/browser/mapsvg-lite-interactive-vector-maps/trunk/php/Domain/SVGFile/SVGFile.php#L24https://plugins.trac.wordpress.org/changeset/3608308/mapsvg-lite-interactive-vector-maps/trunk/php/Domain/SVGFile/SVGFile.phphttps://plugins.trac.wordpress.org/changeset?old_path=%2Fmapsvg-lite-interactive-vector-maps/tags/8.14.0&new_path=%2Fmapsvg-lite-interactive-vector-maps/tags/8.14.1https://www.wordfence.com/threat-intel/vulnerabilities/id/c7f098b9-eca3-41c7-9c74-0f4b3f75c915?source=cve

Dernières Vulnérabilités

CVE-2026-8285

Improper restriction of excessive authentication attempts vulnerability in Universal Software Inc. FlexCity allows Excessive Allocation. This issue affects FlexCity: from 5.536.0 through 11052026.

VOIR DÉTAILS

CVE-2026-8284

URL redirection to untrusted site ('open redirect') vulnerability in Universal Software Inc. FlexCity allows Input Data Manipulation. This issue affects FlexCity: from 5.536.0 through 11052026.

VOIR DÉTAILS

CVE-2026-6792

Missing Authorization vulnerability in Universal Software Inc. FlexCity allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects FlexCity: from 5.536.0 through 11052026.

VOIR DÉTAILS