CVE-2026-16601
Received Received - Intake

Arbitrary File Upload in CM Map Locations WordPress Plugin

Publication date: 2026-08-25

Last updated on: 2026-08-25

Assigner: Wordfence

Description
The CM Map Locations – Visualize and share your locations in a few clicks plugin for WordPress is vulnerable to Limited Arbitrary File Upload in all versions up to, and including, 2.1.8 via the uploadMedia function. This is due to insufficient file type validation in the upload handler, which performs incomplete extension filtering without MIME-type checks or upload capability verification before passing attacker-supplied files to move_uploaded_file(). This makes it possible for authenticated attackers, with subscriber-level access and above, to upload files that may be executable, which makes remote code execution possible. The required nonce is exposed to any logged-in Subscriber via the CMLOC_Editor_Images JavaScript object on the front-end location editor page.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-25
Last Modified
2026-08-25
Generated
2026-08-25
AI Q&A
2026-08-25
EPSS Evaluated
N/A
NVD
CVE-2026-16601
EUVD
EUVD-2026-65313

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
cm_map_locations cm_map_locations to 2.1.8 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-434 The product allows the upload or transfer of dangerous file types that are automatically processed within its environment.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is a Limited Arbitrary File Upload issue in the CM Map Locations WordPress plugin. It allows authenticated attackers with subscriber-level access or higher to upload potentially executable files due to insufficient file type validation. The plugin fails to properly check MIME types or verify upload capabilities before processing files, enabling remote code execution.

Detection Guidance

Check for unauthorized file uploads in the CM Map Locations plugin directory, particularly files with executable extensions like .php, .js, or .html. Inspect the uploadMedia function logs for suspicious activity. Use WordPress admin logs to track subscriber-level access and file uploads.

Impact Analysis

An attacker could exploit this to upload malicious files to your WordPress site, potentially gaining control over it. This could lead to website defacement, data theft, or further attacks against visitors. The vulnerability requires only subscriber-level access, which is a low barrier for exploitation.

Compliance Impact

This vulnerability could lead to unauthorized access or data breaches, violating GDPR and HIPAA requirements for data protection and access controls. Organizations may face fines or penalties if exploited due to inadequate security measures.

Mitigation Strategies

Update the CM Map Locations plugin to the latest version if available. Disable file uploads in the plugin settings or restrict upload permissions to administrators only. Implement server-side file validation to block executable file types. Review and remove any unauthorized files already uploaded.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-16601. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart