WordPress Plugin Arbitrary File Upload via Incomplete Validation

The CM Map Locations – Visualize and share your locations in a few clicks plugin for WordPress is vulnerable to Limited Arbitrary File Upload in all versions up to, and including, 2.1.8 via the uploadMedia function. This is due to insufficient file type validation in the upload handler, which performs incomplete extension filtering without MIME-type checks or upload capability verification before passing attacker-supplied files to move_uploaded_file(). This makes it possible for authenticated attackers, with subscriber-level access and above, to upload files that may be executable, which makes remote code execution possible. The required nonce is exposed to any logged-in Subscriber via the CMLOC_Editor_Images JavaScript object on the front-end location editor page.

Casky was already ahead

This CVE exploits attack patterns that Casky's 447matched skills already investigate — long before this vulnerability was disclosed. Claude's reasoning model maps these techniques to MITRE ATT&CK, so practitioners who ran these skills have already seen the threat behaviour in their findings.

Analysis

The CM Map Locations plugin for WordPress contains a critical arbitrary file upload vulnerability in its uploadMedia function that affects all versions through 2.1.8. The flaw stems from insufficient file type validation—the plugin performs only incomplete extension filtering without checking MIME types or verifying upload capabilities before processing files through move_uploaded_file(). This allows authenticated attackers to upload malicious files (such as PHP shells) to the server, potentially leading to remote code execution and complete site compromise. Organizations running this plugin are at immediate risk, particularly if they have multiple user accounts with upload privileges or if user creation is open.

Casky's 447 mapped security skills leverage Claude's extended reasoning to correlate attack patterns across the three MITRE ATT&CK tactics involved: Initial Access (TA0001), Resource Development (TA0043), and Execution (TA0002). Practitioners using Casky would observe detection findings highlighting the progression from file upload manipulation through improper input validation (CWE-434 context) to post-exploitation execution capabilities. The platform's skills would flag suspicious file uploads with executable extensions, anomalous MIME type mismatches, and unauthorized access to upload handlers—revealing the attack chain before a threat actor can establish persistence. By correlating these technique signatures, Casky helps teams identify both the vulnerability mechanics and the behavioral indicators that would appear in logs and WAF telemetry during exploitation attempts.

Live Threat IntelligenceComing soon

Casky Risk Score

—

EPSS Probability

—

Shodan Exposure

—

GreyNoise Signal

—

Composite risk scoring from EPSS, CISA KEV, Shodan, and GreyNoise — 21 security APIs correlated into a single Casky Risk Score. Coming in Casky Pro. Join early access →

447 Casky skills cover this attack pattern

These skills use Claude AI's reasoning model to surface findings in the same attack categories as CVE-2026-16601.

Abuse of Public-Facing API: Mobile API Abuse

mobile security · low

Run

abusing-dpapi-for-credential-access

red teaming · high

Run

abusing-shadow-credentials-for-privesc

red teaming · high

Run

MITRE ATT&CK Techniques

TA0001 TA0043 TA0002

Investigate the attack patterns behind CVE-2026-16601

Casky has 447 skills that investigate the attack patterns behind CVE-2026-16601. Run one and get CVSS-scored findings in 3 minutes.

Run the skill that detects this →

X Instagram LinkedIn