Unauthenticated Server Side Request Forgery in MapSVG Plugin by WordPress
CVE-2026-82852

5.4MEDIUM

Key Information:

Vendor

WordPress
Status
Mapsvg
Vendor
CVE Published:
31 August 2026

What is CVE-2026-82852?

The MapSVG plugin for WordPress, in versions up to 8.15.0, contains an unauthenticated Server Side Request Forgery (SSRF) vulnerability. This flaw enables attackers to send unauthorized requests from the server to internal resources, potentially exposing sensitive data or enabling further attacks within the network. Organizations using this plugin should prioritize addressing this vulnerability to safeguard their applications.

Affected Version(s)

MapSVG <= 8.15.0

References

https://patchstack.com/database/wordpress/plugin/mapsvg-l...
vdb-entry

CVSS V3.1

Score:
5.4
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
High
Privileges Required:
None
User Interaction:
None
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Adam Kahlon (Adkali) | Patchstack Bug Bounty Program
.