CVE-2026-16601: CWE-434 Unrestricted Upload of File with Dangerous Type in creativemindssolutions CM Map Locations – Visualize and share your locations in a few clicks

CVE-2026-16601 describes a limited arbitrary file upload vulnerability in the CM Map Locations WordPress plugin up to and including version 2.1.8. The vulnerability arises from insufficient file type validation in the uploadMedia function, which performs only partial extension filtering without verifying MIME types or upload capabilities before moving uploaded files. Authenticated users with subscriber-level privileges can exploit this flaw to upload files that may be executed remotely, potentially leading to remote code execution. The nonce required for the upload action is exposed to all logged-in subscribers through the CMLOC_Editor_Images JavaScript object on the front-end location editor page.

An attacker with subscriber-level access can upload malicious files that may be executed on the server, leading to remote code execution. This compromises the confidentiality, integrity, and availability of the affected system. The vulnerability has a high CVSS score of 8.8, indicating a severe impact if exploited.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict subscriber-level access where possible and monitor for suspicious file uploads. Avoid granting unnecessary upload permissions to low-privilege users. Follow vendor updates closely for an official patch or temporary mitigation.