The CM Map Locations WordPress plugin contains a high-severity arbitrary file upload vulnerability that could lead to remote code execution.

This is an unrestricted file upload vulnerability (CWE-434). It allows an authenticated user to bypass file type restrictions, potentially enabling the upload of executable code onto the server.

A successful exploit allows an attacker to upload arbitrary files, which may be executed by the server, leading to full site compromise. With a CVSS score of 8.8, this vulnerability presents a severe risk to confidentiality, integrity, and availability.

Immediate Action: Update the CM Map Locations plugin to version 2.1.9 or later, where security patches for file uploads have been applied.

Proactive Monitoring: Scan the uploads directory for suspicious or non-standard file extensions and monitor server access logs for anomalous file requests.

Compensating Controls: Configure the web server to disable script execution within the plugin's uploads directory and utilize a WAF to filter malicious file upload attempts.

Public Exploit Available: Unknown.

Immediate action is required to patch this vulnerability. Organizations should update the CM Map Locations plugin to version 2.1.9 immediately to prevent unauthorized file uploads, which could be leveraged to gain persistence or remote code execution on the underlying server.