Limited Arbitrary File Upload Vulnerability in CM Map Locations Plugin for WordPress

CVE-2026-16601

What is CVE-2026-16601?

The CM Map Locations plugin for WordPress is susceptible to a Limited Arbitrary File Upload vulnerability due to insufficient validation of file types in the upload handler. This flaw allows authenticated attackers, with at least Subscriber-level access, to upload potentially executable files, resulting in the risk of remote code execution. The vulnerability arises from the lack of MIME-type checks and verification of upload capabilities before files are processed. Additionally, the nonce used for file uploads is exposed to any logged-in Subscriber, increasing the potential for exploitation.

References