VulnSocial

CVE-2026-1771Disclosure

LOWCVSS 7.2 · HIGH

Signal is active with 2 mentions in latest observed window

Immediate actions

  • Patch affected systems immediately

Recommended action window: Monitor and triage in normal cycle

NVD description

The MapSVG plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the SVGFile constructor in all versions up to, and including, 8.14.0 This is due to an incorrect conditional check that prevents file validation from taking place. This makes it possible for authenticated attackers, with Administrator-level access and above, to upload arbitrary files on the affected site's server which may make remote code execution possible.

Back to dashboard
0.5/ 10 priority

Sources & remediation

Other references
Weakness type (CWE)
CWE-20

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

AVAILABLE

Momentum

NONE

Threat summary

  • Patch or workaround signal is available
  • 2 mentions across 1 observed day

What's happening

  • Patch or workaround mentioned in 1 signal
  • Technical details provided in 2 signals
  • Disclosure: 1 classified signal
  • 2 total mentions across 1 day

Deep dive

Activity timeline2 mentions / 1d
01122Mentions · 2026-07-21: 2Patch / Workaround · 2026-07-21: 1Technical Details · 2026-07-21: 207-21
Signal classification2 categories
Disclosure
150.0%
Patch
150.0%
Referenced assets2 URLs
Full discourse2 posts
  • Hugo | DevOps | Cybersecurity 🇱🇻@HugoValters
    Patch

    #CVE-2026-1771 - Critical RCE in Mapsvg #WordPress plugin. Arbitrary file upload due to missing validation. #CVSS 7.2. Unpatched. Update immediately or restrict admin access. #CVEAlert #devsecops #devops #developer #git #github #gitlab #infosec https://www.valtersit.com/cve/CVE-2026-1771

    Post summary

    The post highlights a critical RCE in the Mapsvg WordPress plugin that is unpatched and recommends updating the plugin or restricting admin access, but offers no PoC, exploit, or evidence of active exploitation.

    0000046
    986 followersView on X
  • Vulmon Vulnerability Feed@VulmonFeeds
    Disclosure

    CVE-2026-1771 Arbitrary File Upload Vulnerability in MapSVG WordPress Plugin Up to 8.14.0 https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-1771

    Post summary

    The post reports CVE-2026-1771, an arbitrary file upload flaw affecting MapSVG WordPress plugin up to version 8.14.0.

    00000112
    4.1K followersView on X

Explore more

Back to dashboard