CVE-2026-16601: CM Map Locations WordPress Plugin RCE Flaw

CVE-2026-16601 Overview

CVE-2026-16601 is an arbitrary file upload vulnerability in the CM Map Locations WordPress plugin affecting all versions up to and including 2.1.8. The flaw resides in the uploadMedia function inside DashboardController.php, which performs incomplete extension filtering and lacks MIME-type validation or capability checks before calling move_uploaded_file(). Authenticated attackers with Subscriber-level access can upload executable files and achieve remote code execution on the underlying web server. The required nonce is exposed to any logged-in Subscriber through the CMLOC_Editor_Images JavaScript object rendered on the front-end location editor page, lowering the barrier to exploitation. The vulnerability is tracked under [CWE-434: Unrestricted Upload of File with Dangerous Type].

Critical Impact
Authenticated Subscriber-level users can upload arbitrary files to WordPress sites running CM Map Locations 2.1.8 or earlier, resulting in remote code execution and full site compromise.

Affected Products

CM Map Locations – Visualize and share your locations in a few clicks (WordPress plugin) versions ≤ 2.1.8
WordPress sites permitting Subscriber-level registration with the vulnerable plugin installed
Fixed in CM Map Locations version 2.1.9

Discovery Timeline

2026-08-25 - CVE-2026-16601 published to NVD
2026-08-27 - Last updated in NVD database

Technical Details for CVE-2026-16601

Vulnerability Analysis

The vulnerability exists in the uploadMedia handler defined in controller/DashboardController.php around line 105 of the 2.1.8 release. The handler receives attacker-supplied files and forwards them to move_uploaded_file() after only cursory extension checks. It does not verify MIME type, does not enforce a strict allow-list, and does not confirm the caller holds the upload_files capability.

Any authenticated user, including default WordPress Subscribers, can invoke the upload flow. The nonce required by the endpoint is emitted client-side within the CMLOC_Editor_Images JavaScript object on the location editor page. A Subscriber can retrieve that nonce by rendering the page and reuse it to submit uploads that resolve to PHP or other server-executed content.

Once a PHP file lands inside the WordPress uploads directory, the attacker requests it directly to execute arbitrary code under the web server user. This yields full site compromise, database access, and a pivot point into other tenants sharing the host.

Root Cause

The root cause is insufficient input validation on file uploads. The plugin relies on a partial extension blocklist rather than a strict allow-list, omits wp_check_filetype_and_ext()-style MIME validation, and skips the current_user_can('upload_files') capability check that WordPress requires for media handling.

Attack Vector

An attacker registers or authenticates as a Subscriber on a site running CM Map Locations ≤ 2.1.8. The attacker loads the front-end location editor page to harvest the AJAX nonce from the CMLOC_Editor_Images JavaScript object. The attacker then sends a multipart POST to the plugin's upload AJAX action with a crafted filename that bypasses the extension filter. After the file is written into the uploads directory, the attacker requests the resulting URL to trigger code execution.

See the Wordfence Vulnerability Report and the vulnerable DashboardController source for the exact code paths.

Detection Methods for CVE-2026-16601

Indicators of Compromise

Unexpected .php, .phtml, .phar, or double-extension files under wp-content/uploads/ subdirectories used by CM Map Locations
POST requests to admin-ajax.php with the plugin's upload action originating from Subscriber accounts
Newly created WordPress administrator accounts or modified wp_options entries shortly after upload activity
Outbound connections from the web server process to attacker-controlled infrastructure following upload events

Detection Strategies

Inspect web server access logs for admin-ajax.php calls referencing the CM Map Locations upload action followed by direct GET requests to files under /wp-content/uploads/
Hunt file system telemetry for executable content written to the uploads directory by the PHP-FPM or Apache user
Correlate low-privilege authentication events with subsequent file write and process execution activity on the web tier

Monitoring Recommendations

Enable file integrity monitoring on the WordPress wp-content/uploads/ tree and alert on new script extensions
Log and review Subscriber-level account creation, especially on sites that expose open registration
Forward WordPress and web server logs to a centralized analytics platform for anomaly detection on plugin AJAX endpoints

How to Mitigate CVE-2026-16601

Immediate Actions Required

Update the CM Map Locations plugin to version 2.1.9 or later on all WordPress installations
Audit wp-content/uploads/ for unauthorized files and remove any executable content that does not belong
Review WordPress user accounts and revoke unknown Subscriber, Editor, or Administrator accounts created recently
Rotate WordPress secret keys, administrator passwords, and any credentials stored in wp-config.php if compromise is suspected

Patch Information

The vendor addressed the issue in CM Map Locations 2.1.9. Review the plugin changeset for the fix and the version diff between 2.1.8 and 2.1.9 for the corrected upload handler.

Workarounds

Deactivate the CM Map Locations plugin until the update to 2.1.9 can be deployed
Disable open user registration or restrict registration to trusted domains to eliminate the Subscriber prerequisite
Block PHP execution inside wp-content/uploads/ at the web server layer using directory-level handler rules
Deploy a web application firewall rule that blocks POST requests to the plugin's upload AJAX action for non-privileged roles

bash

# Apache: prevent PHP execution inside the WordPress uploads directory
<Directory "/var/www/html/wp-content/uploads">
    <FilesMatch "\.(php|phtml|phar|php[0-9]+)$">
        Require all denied
    </FilesMatch>
</Directory>

# Nginx equivalent
location ~* /wp-content/uploads/.*\.(php|phtml|phar|php[0-9]+)$ {
    deny all;
    return 403;
}