CVE-2026-16601 in CM Map Locations Plugin
Summary
by MITRE • 08/25/2026
The CM Map Locations – Visualize and share your locations in a few clicks plugin for WordPress is vulnerable to Limited Arbitrary File Upload in all versions up to, and including, 2.1.8 via the uploadMedia function. This is due to insufficient file type validation in the upload handler, which performs incomplete extension filtering without MIME-type checks or upload capability verification before passing attacker-supplied files to move_uploaded_file(). This makes it possible for authenticated attackers, with subscriber-level access and above, to upload files that may be executable, which makes remote code execution possible. The required nonce is exposed to any logged-in Subscriber via the CMLOC_Editor_Images JavaScript object on the front-end location editor page.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 08/25/2026
The vulnerability identified in the CM Map Locations plugin for WordPress represents a critical security flaw rooted in insufficient input validation within its media upload functionality. Specifically, the issue resides in the uploadMedia function present in all versions up to and including 2.1.8. The core technical failure is an incomplete extension filtering mechanism that fails to perform adequate MIME-type checks or verify user upload capabilities before processing files. This architectural weakness allows attacker-supplied files to be passed directly to the PHP move_uploaded_file() function without rigorous sanitization, creating a pathway for Limited Arbitrary File Upload.
From a classification perspective, this vulnerability aligns with CWE-434, which describes the unrestricted upload of file with dangerous type, and CWE-20, indicating improper input validation. The lack of MIME-type verification means that files are accepted based primarily on their extension rather than their actual content structure or security properties. This oversight is particularly severe because it bypasses standard server-side defenses designed to prevent malicious payloads from being executed as scripts.
The operational impact of this flaw is significant due to the low privilege level required for exploitation. The vulnerability can be exploited by authenticated attackers with subscriber-level access and above, which are relatively common roles in WordPress installations where users may have limited administrative rights but still possess certain interactive capabilities. Furthermore, the security model is further compromised because the required nonce, typically used to prevent Cross-Site Request Forgery attacks, is exposed via the CMLOC_Editor_Images JavaScript object on the front-end location editor page. This exposure allows any logged-in subscriber to easily obtain a valid CSRF token, thereby facilitating automated exploitation without requiring complex social engineering or session hijacking techniques.
Consequently, this combination of factors enables remote code execution if an attacker uploads a malicious PHP file disguised with a permitted extension such as .jpg or .png but containing executable script content. Once uploaded and accessed via the web server's document root, these files can be executed by the server, granting the attacker full control over the underlying system depending on the permissions of the web service account. This scenario maps directly to ATT&CK technique T1505.003, Server Software Component: Web Shell, as well as T1059.004 for command and scripting interpreter abuse via uploaded scripts.
Mitigation strategies must prioritize immediate remediation through software updates or manual code intervention. Administrators should upgrade the CM Map Locations plugin to a version that addresses this flaw if available from the vendor. If an update is not immediately accessible, temporary mitigation involves restricting file upload permissions at the server level and ensuring that directories used for uploads do not have execute permissions enabled. Additionally, implementing strict MIME-type validation on both client and server sides, along with verifying nonce integrity against session data rather than relying solely on front-end exposure, can help mitigate similar risks in other plugins or future versions of this software.