Skip to content

CVE-2026-16601 — The CM Map Locations – Visualize and share your locations in a few clicks plugin for…

Key facts

CVE-2026-16601 is a High (8.8) vulnerability: The CM Map Locations – Visualize and share your locations in a few clicks plugin for…. This entry ships a detection-only PoC and a Docker test lab.
CVE CVE-2026-16601
Severity High (8.8)
Detection / prevention —
PoC poc.py
Source 2026/CVE-2026-16601/

Details

English | 한국어

Description

The CM Map Locations – Visualize and share your locations in a few clicks plugin for WordPress is vulnerable to Limited Arbitrary File Upload in all versions up to, and including, 2.1.8 via the uploadMedia function. This is due to insufficient file type validation in the upload handler, which performs incomplete extension filtering without MIME-type checks or upload capability verification before passing attacker-supplied files to move_uploaded_file(). This makes it possible for authenticated attackers, with subscriber-level access and above, to upload files that may be executable, which makes remote code execution possible. The required nonce is exposed to any logged-in Subscriber via the CMLOC_Editor_Images JavaScript object on the front-end location editor page.

Vulnerability Details

Property Value
CVE ID CVE-2026-16601
Type RCE
CVSS Score 8.8

Proof of Concept

Download

# Download PoC script
curl -O https://raw.githubusercontent.com/fankh/vulnerability-poc/main/2026/CVE-2026-16601/poc.py

Usage

# Run PoC against target
python3 poc.py --target <TARGET_URL>

# With authentication
python3 poc.py --target <TARGET_URL> --username <USER> --password <PASS>

⚠️ Warning: This PoC is for authorized security testing only. It uses detection-only techniques and does not exploit or damage target systems.

Test Lab

This repository includes a Docker-based test environment with both vulnerable and patched applications.

Quick Start

# Clone and navigate to CVE directory
cd CVE-2026-16601

# Start both applications
docker-compose up -d

# Run tests
./run-tests.sh    # Linux/Mac
./run-tests.ps1   # Windows PowerShell

Application Endpoints

Application URL Status
Vulnerable App http://localhost:8080 Shows vulnerability
Patched App http://localhost:8081 Demonstrates fix

Directory Structure

├── README.md           # English documentation
├── README_KO.md        # Korean documentation
├── poc.py              # PoC detection script
├── docker-compose.yml  # Container orchestration
├── run-tests.sh        # Linux/Mac test runner
├── run-tests.ps1       # Windows test runner
├── vulnerable-app/     # Vulnerable version
│   ├── app.py
│   ├── Dockerfile
│   └── requirements.txt
└── patched-app/        # Fixed version
    ├── app.py
    ├── Dockerfile
    └── requirements.txt

References

  • https://plugins.trac.wordpress.org/browser/cm-map-locations/tags/2.1.8/controller/DashboardController.php#L105
  • https://plugins.trac.wordpress.org/browser/cm-map-locations/tags/2.1.8/controller/DashboardController.php#L385
  • https://plugins.trac.wordpress.org/browser/cm-map-locations/tags/2.1.8/core/controller/Controller.php#L45
  • https://plugins.trac.wordpress.org/browser/cm-map-locations/tags/2.1.8/model/Attachment.php#L240
  • https://plugins.trac.wordpress.org/browser/cm-map-locations/tags/2.1.8/model/Route.php#L362
  • https://plugins.trac.wordpress.org/changeset/3626848/cm-map-locations/trunk/controller/DashboardController.php
  • https://plugins.trac.wordpress.org/changeset?old_path=%2Fcm-map-locations/tags/2.1.8&new_path=%2Fcm-map-locations/tags/2.1.9
  • https://plugins.trac.wordpress.org/changeset?reponame=&new=3626853%40cm-map-locations%2Ftags%2F2.1.9&old=3544748%40cm-map-locations%2Ftags%2F2.1.8
  • https://www.wordfence.com/threat-intel/vulnerabilities/id/41308ae8-1b3d-4658-808d-630d6e673f3f?source=cve

Generated by PoC Generator on 2026-08-25T20:08:46.16883527

Frequently asked questions

What is CVE-2026-16601?

CVE-2026-16601 is a High (8.8) vulnerability: The CM Map Locations – Visualize and share your locations in a few clicks plugin for…. This entry ships a detection-only PoC and a Docker test lab.

How do I detect CVE-2026-16601?

Run the detection-only PoC included with this entry against your Docker test lab to confirm whether a target is affected; pair it with your own IDS logging.

How do I block or mitigate CVE-2026-16601?

Upgrade to a fixed version per the vendor advisory; the NVD record lists the affected versions. Use the included PoC to verify your remediation.

For authorized security testing and research only. See the full source and NVD record.