CVE-2025-48120: MapSVG Code Injection Vulnerability

CVE-2025-48120 Overview

CVE-2025-48120 is a code injection vulnerability in the RomanCode MapSVG Lite Interactive Vector Maps plugin for WordPress. The flaw allows arbitrary shortcode execution through improper control of code generation [CWE-94]. It affects all plugin versions up to and including 8.6.9. An unauthenticated attacker can reach the vulnerable code path over the network without user interaction. Successful exploitation exposes information rendered through arbitrary WordPress shortcodes on the affected site. The issue was reported through the Patchstack vulnerability disclosure program.

Critical Impact
Unauthenticated attackers can trigger arbitrary shortcode execution on WordPress sites running MapSVG Lite <= 8.6.9, exposing shortcode output and enabling abuse of any installed shortcode-based functionality.

Affected Products

RomanCode MapSVG Lite Interactive Vector Maps plugin for WordPress
All versions from initial release through 8.6.9
WordPress sites with the plugin installed and active

Discovery Timeline

2025-05-16 - CVE-2025-48120 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-48120

Vulnerability Analysis

The vulnerability resides in how MapSVG Lite handles user-controllable input that is passed to WordPress shortcode processing. The plugin fails to restrict which shortcodes can be executed through its request handling path. As a result, an attacker can supply arbitrary shortcode names and attributes, and the plugin will invoke WordPress core shortcode rendering on that input. Any shortcode registered on the site becomes reachable, including shortcodes from other plugins that may expose sensitive data. The Patchstack advisory categorizes the issue as arbitrary shortcode execution, a subclass of code injection under [CWE-94]. The impact is limited to confidentiality — the attacker reads the output of executed shortcodes but does not directly modify data or crash the service.

Root Cause

The root cause is missing allow-list validation on shortcode identifiers processed by the plugin. The plugin invokes WordPress shortcode rendering on attacker-supplied input without confirming the shortcode belongs to MapSVG. This violates the principle that user input must never determine which code path executes.

Attack Vector

An unauthenticated remote attacker sends a crafted HTTP request to the WordPress site. The request specifies an arbitrary shortcode name and parameters. The plugin renders the shortcode and returns the result to the attacker. No authentication, privileges, or user interaction are required. Details are documented in the Patchstack Plugin Vulnerability Report.

Detection Methods for CVE-2025-48120

Indicators of Compromise

HTTP requests to admin-ajax.php or MapSVG plugin endpoints containing unexpected shortcode identifiers not associated with map rendering
Anomalous responses containing rendered shortcode output such as user lists, form data, or content from unrelated plugins
Repeated requests from a single source enumerating different shortcode names

Detection Strategies

Inspect web server access logs for POST or GET parameters carrying [shortcode] syntax targeting MapSVG endpoints
Deploy Web Application Firewall (WAF) rules that block shortcode syntax in parameters bound for the MapSVG plugin
Correlate WordPress plugin inventories with the vulnerable version range <= 8.6.9 across managed sites

Monitoring Recommendations

Alert on outbound responses from WordPress that contain shortcode output patterns tied to sensitive plugins such as membership, forms, or user directories
Monitor for spikes in request volume to MapSVG plugin URIs
Track file integrity for the mapsvg-lite-interactive-vector-maps plugin directory to detect tampering during exploitation attempts

How to Mitigate CVE-2025-48120

Immediate Actions Required

Identify all WordPress instances running MapSVG Lite Interactive Vector Maps at version 8.6.9 or earlier
Update the plugin to a fixed version released after 8.6.9 once available from the vendor
If no patched version is available, deactivate and remove the plugin from affected sites
Review WordPress access logs for prior exploitation attempts referencing shortcode parameters

Patch Information

Consult the Patchstack Plugin Vulnerability Report for the latest fixed version and vendor guidance. Apply the update through the WordPress plugin management interface or automate deployment across managed sites.

Workarounds

Block requests to MapSVG plugin endpoints at the WAF level until patching is complete
Restrict access to wp-admin/admin-ajax.php from untrusted sources where feasible
Audit installed shortcodes and disable any that expose sensitive information when rendered without context

bash

# Identify vulnerable MapSVG Lite installations via WP-CLI
wp plugin list --name=mapsvg-lite-interactive-vector-maps --fields=name,status,version

# Deactivate the plugin as a temporary mitigation
wp plugin deactivate mapsvg-lite-interactive-vector-maps