MapPress Maps for WordPress <= 2.73.12 - Admin+ File Upload to Remote Code Execution

Unrestricted Upload of File with Dangerous Type
CVE CVE-2022-0537
CVSS Medium (6)
Publicly Published March 14, 2022
Last Updated January 22, 2024
Researcher qerogram
Description

The MapPress Maps for WordPress plugin before 2.73.13 allows a high privileged user to bypass the DISALLOW_FILE_EDIT and DISALLOW_FILE_MODS settings and upload arbitrary files to the site through the "ajax_save" function. The file is written relative to the current 's stylesheet directory, and a .php file extension is added. No validation is performed on the content of the file, triggering an RCE vulnerability by uploading a web shell. Further the name parameter is not sanitized, allowing the payload to be uploaded to any directory to which the server has write access.

References

1 affected software package

Software Type Plugin
Software Slug mappress-google-maps-for-wordpress (view on wordpress.org)
Patched? Yes
Affected Version
  • <= 2.73.13
Patched Version
  • 2.73.13
This record contains material that is subject to copyright

Copyright 2012-2026 Defiant Inc.
License: Defiant hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute this software vulnerability information. Any copy of the software vulnerability information you make for such purposes is authorized provided that you include a hyperlink to this vulnerability record and reproduce Defiant's copyright designation and this license in any such copy. License Detail.