CVE-2026-16601

Executive Summary

CVE-2026-16601 is a Limited Arbitrary File Upload vulnerability in the CM Map Locations – Visualize and share your locations in a few clicks WordPress plugin, affecting all versions up to and including 2.1.8. The flaw resides in the uploadMedia function, which performs incomplete extension filtering without MIME-type validation or upload capability checks, enabling authenticated attackers with subscriber-level access to upload potentially executable files and achieve remote code execution. With a CVSS score of 8.8 (High), the vulnerability exposes WordPress sites running this plugin to full host compromise — authentication bypass is not required beyond the standard subscriber account, which significantly broadens the attack surface to any user that can register or be provisioned on the target site. No public PoC or exploit code has been observed at the time of this report, and the patch status is based on a single unconfirmed source.

Technical Analysis

The vulnerability class is CWE-434 (Unrestricted Upload of File with Dangerous Type), specifically manifested as a limited arbitrary file upload flaw. Root cause analysis based on the NVD description identifies three critical deficiencies in the upload handler:

1. Incomplete Extension Filtering: The uploadMedia function applies partial extension denylist/allowlist logic but fails to block all dangerous file types. The insufficient validation permits extensions such as .php, .php5, .phtml, or web-shell-compatible variants to pass when crafted to bypass the incomplete list (e.g., double extensions, case variation, or null-byte injection if filesystem permits).

2. Missing MIME-Type Validation: File uploads are processed without verifying the Content-Type or inspecting the file header (magic bytes). An attacker can upload a PHP script disguised with a benign content-type header (e.g., image/png) while the actual payload remains executable.

3. No Capability Check: The upload handler does not verify the current user's WordPress role/capability (e.g., upload_files, unfiltered_upload). Standard subscriber accounts are granted the necessary permissions to reach the vulnerable code path through the front-end location editor page.

The upload flow relies on PHP's move_uploaded_file() function, which moves attacker-controlled files from the temporary directory to a web-accessible location. Because nonce validation is weak — with the CMLOC_Editor_Images JavaScript object exposing the nonce to any logged-in subscriber — attackers can forge valid requests to the upload endpoint without guessing the nonce value. The combination of insufficient validation and exposed nonce results in an unauthenticated-by-architecture but authenticated-by-design access control bypass leading to arbitrary file upload.

The attack surface is the WordPress front-end, specifically the location editor page that loads the CMLOC_Editor_Images JavaScript object. This object exposes the nonce value needed to invoke uploadMedia, effectively turning any authenticated subscriber into a potential code-execution vector. The CVSS vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) reflects the network-reachable, low-complexity nature of exploitation with only low-privilege (Subscriber+) authentication required, and no user interaction.

Exploitation Scenarios

Step 1 — Reconnaissance and Target Identification: An attacker first identifies WordPress sites running the CM Map Locations plugin. This can be done via fingerprinting the plugin directory (wp-content/plugins/cm-map-locations/), detecting the plugin's JavaScript assets, or searching for the CMLOC_Editor_Images object in page source. Shodan-style passive scanning (dorks listed in metadata) can reveal exposed sites. The attacker also obtains or registers a subscriber-level account on the target — if registration is open, this is trivial; otherwise, they may compromise a low-privilege account via credential stuffing or social engineering.

Step 2 — Vulnerability Trigger: The attacker navigates to the front-end location editor page, which loads the CMLOC_Editor_Images JavaScript object. From the page source, they extract the exposed nonce value associated with the uploadMedia function. The attacker then crafts an HTTP multipart POST request to the plugin's upload handler, including: (a) the nonce recovered from the JavaScript object, (b) a malicious file payload (e.g., a PHP web shell) with an extension that bypasses the incomplete filter — such as shell.php.png if the denylist only blocks specific top-level extensions, or shell.ph%70 encoded variations, and (c) a benign Content-Type header (e.g., image/jpeg) to pass the absent MIME check.

Step 3 — Execution: Once uploaded, move_uploaded_file() places the file in a web-accessible directory (commonly under wp-content/uploads/ or a plugin-specific upload folder). The attacker navigates directly to the uploaded file URL — e.g., /wp-content/uploads/shell.png.php or whatever the filtered extension resolves to — and the web server executes the PHP code, delivering a reverse shell or web shell to the attacker.

Step 4 — Post-Exploitation Impact: With a web shell running under the web server user (typically www-data on Linux or IIS AppPool on Windows), the attacker achieves: (a) full confidentiality breach (reading wp-config.php for database credentials), (b) integrity compromise (modifying site files, injecting backdoors, altering content), and (c) availability impact (site defacement, ransomware, or complete host takeover via privilege escalation to root). The CVSS scoring of C:H/I:H/A:H confirms maximum impact across all security pillars.

Note: No public PoC or exploit code is available at the time of writing. This attack chain is inferred from the vulnerability class (CWE-434) and the limited technical details in the NVD description. Actual exploitation may require adaptation based on the exact plugin codebase.

Impact Assessment

Business Impact: The vulnerability compromises the entire WordPress instance and potentially the underlying host. Given the plugin's purpose — location visualization and sharing — affected organizations range from small businesses with a single WordPress site to enterprises using WordPress as a CMS for public-facing properties. The authentication requirement (Subscriber+) is a minimal barrier: any site with open registration or guest subscriber provisioning is effectively exposed to unprivileged attackers.

Blast Radius:

• Data Confidentiality: Attackers can read database credentials from wp-config.php, exfiltrate user data, and access any stored information (customer data, payment records if e-commerce plugins are present).
• Site Integrity: Full web root write access enables site defacement, SEO spam injection, malware distribution (drive-by downloads), and long-term persistent backdoors.
• Availability: Attackers can delete files, corrupt the database, or use the host for denial-of-service campaigns.
• Downstream Risks: Compromised WordPress hosts are commonly weaponized for phishing infrastructure, cryptocurrency miners, and botnet participation. Lateral movement to internal networks is possible if the web server has outbound connectivity to internal services.

Severity Context: CVSS 8.8 (High) is justified — low-privilege authentication, network exploitability, no user interaction, and full impact across CIA triad. The limited complexity classification (AC:L) suggests exploitation does not require special conditions beyond standard web request crafting.

Affected Systems: All WordPress installations running CM Map Locations plugin version ≤ 2.1.8. The exact installed base is unknown, but the plugin is listed on WordPress.org's plugin directory based on the "CM" vendor prefix market (CreativeMinds is the likely vendor, though unconfirmed), which typically maintains a significant number of active installations.

Detection Guidance

Sigma Rule

title: CM Map Locations Arbitrary File Upload Attempt
id: 3d4fe7fc-8846-4c2e-bd62-99d732d54a7e
status: experimental
description: Detects POST requests to the CM Map Locations upload endpoint with suspicious file extensions or absence of MIME-type checks
author: Valtersit Threat Intelligence
date: 2026/05/15
logsource:
  category: webserver
  product: apache
  definition: Access logs for WordPress web server
detection:
  selection_path:
    cs-method: 'POST'
    cs-uri-stem|contains: 'admin-ajax.php'
    cs-uri-query|contains: 
      - 'action=uploadMedia'
      - 'cmloc'
  selection_extensions:
    cs-uri-query|contains:
      - '.php'
      - '.phtml'
      - '.php5'
      - '.pht'
  selection_response:
    sc-status: 200
  condition: selection_path and selection_extensions and selection_response
  timeframe: 5m
fields:
  - c-ip
  - cs-user-agent
  - cs-uri-query
falsepositives:
  - Legitimate admin uploads of PHP files (low likelihood in subscriber context)
level: high

YARA Rule

rule CM_Map_Locations_Upload_Shell
{
    meta:
        author = "Valtersit Threat Intelligence"
        description = "Detects PHP webshell payloads uploaded via CM Map Locations vulnerable handler"
        cve = "CVE-2026-16601"
        date = "2026-05-15"
    strings:
        $php_open = "<?php"
        $shell_funcs = /(eval|system|exec|passthru|shell_exec|base64_decode)\(/
        $nonce_ref = "CMLOC_Editor_Images"
        $upload_ref = "uploadMedia"
        $bad_ext = /\.(php|phtml|php5|pht)(\.|$)/
    condition:
        $php_open and $shell_funcs and ($bad_ext or $nonce_ref or $upload_ref)
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-16601 CM Map Locations Arbitrary File Upload Attempt"; flow:established,to_server; http.method; content:"POST"; http.uri; content:"admin-ajax.php"; nocase; http.uri; content:"action=uploadMedia"; nocase; http.request_body; content:"filename="; nocase; http.request_body; pcre:"/filename=[^&\r\n]+\.(php|phtml|php5|pht)/i"; http.request_body; pcre:"/filename=[^&\r\n]+\.(jpg|png|gif)\.[^&\r\n]+\.(php|phtml)/i"; sid:202616601; rev:1; metadata:cve CVE-2026-16601, category attempted-admin; reference:url,https://nvd.nist.gov/vuln/detail/CVE-2026-16601;)

Elastic Detection

sequence by source.ip with maxspan=5m
  [file where process.name == "httpd" or "nginx" or "apache2" and
   file.extension in ("php", "phtml", "php5", "pht") and
   file.path contains "uploads" and
   file.path contains "cmloc"]
  [network where direction == "egress" and destination.port in (80, 443) and
   process.name in ("php-fpm", "php") and
   event.type == "start"]

Splunk SPL Query

index=webserver sourcetype=access_combined
| search "POST" AND "admin-ajax.php"
| regex _raw="action=(uploadMedia|cmloc[^\s&]*upload)"
| regex _raw="filename=[^\s&]+\.(php|phtml|php5|jsp|asp|aspx|pht)"
| stats count by src_ip, cs_uri_stem, status
| where count > 3
| sort - count

Wazuh OSSEC Rule

<group name="wordpress,upload,php,">
  <rule id="109001" level="12">
    <decoded_as>json</decoded_as>
    <field name="url">admin-ajax\.php</field>
    <field name="http_method">POST</field>
    <regex>uploadMedia</regex>
    <regex>filename.*\.(php|phtml|php5)\b</regex>
    <description>CVE-2026-16601: Potential CM Map Locations arbitrary file upload attempt detected</description>
    <group>wordpress_attack,phishing,</group>
    <mitre>
      <id>T1213</id>
    </mitre>
  </rule>
</group>

Mitigation & Patch Guidance

Patch Status: The NVD records a claimed patch (confidence 2/4 — single source, not independently confirmed). The patch source is NVD, but the specific patched version or vendor advisory URL is not available. Until confirmed, treat as unpatched.

Immediate Mitigations:

1. Disable the plugin: If business continuity is not dependent on CM Map Locations, deactivate and delete it immediately.
2. Restrict subscriber permissions: Disable user registration if not required. If registration is needed, implement a manual approval workflow to prevent casual subscriber account creation.
3. WAF rules: Deploy the Suricata/YARA rules above at the web application firewall to block POST requests to admin-ajax.php with uploadMedia action and suspicious file extensions.
4. Filesystem hardening: Configure PHP's upload_tmp_dir to a read-only separator, disable allow_url_fopen and allow_url_include, and use open_basedir to restrict the web user's filesystem access.
5. Directory execution prevention: Deny PHP execution in the uploads directory via .htaccess (Apache) or Nginx location block / IIS request filtering.

Patch/Upgrade Steps:

1. Monitor WordPress plugin update notifications for CM Map Locations. If a version > 2.1.8 is released, test in staging and deploy immediately.
2. If the vendor (likely CreativeMinds, though unconfirmed) provides a manual patch or hotfix, apply per their guidance.
3. Audit the plugin's codebase (if open) or request a security update confirmation from the vendor. Verify the patch addresses all three weaknesses: extension filtering completeness, MIME-type validation, and capability checks.

Long-Term Hardening:

1. WordPress security baseline: Enforce least-privilege user roles. Ensure only Administrators have unfiltered_upload capability. Implement a security plugin (e.g., Wordfence, Sucuri) with virtual patching.
2. Upload validation: Apply a global upload validation layer (WordPress filter on wp_handle_upload or upload_mimes) that blocks executable extensions and validates MIME types server-side.
3. Monitoring: Deploy the detection guidance rules above in SIEM/SIM. Establish baseline alerting for file uploads from subscriber-level accounts.
4. Incident readiness: Maintain offline backups, test restoration procedures, and ensure the web server runs with a non-privileged service account.
5. Subscriber account hygiene: Periodically audit subscriber accounts. Remove dormant accounts and enforce strong password policies and MFA for all user levels if feasible.

References

1. NVD Entry — https://nvd.nist.gov/vuln/detail/CVE-2026-16601 (official CVE description, CVSS vector, patch claim).
2. CWE-434 Unrestricted Upload of File with Dangerous Type — https://cwe.mitre.org/data/definitions/434.html (vulnerability class reference for mitigation context).
3. MITRE ATT&CK — Exploitation for Client Execution (T1213) — https://attack.mitre.org/techniques/T1213/ (tactical mapping for the upload-to-code-execution chain).
4. Wordfence Threat Intelligence (general WordPress file upload advisory series) — https://www.wordfence.com/blog/category/vulnerabilities/ (reference for pattern of file upload CVEs in WordPress plugins).
5. CISA Known Exploited Vulnerabilities Catalog — https://www.cisa.gov/known-exploited-vulnerabilities-catalog (CVE-2026-16601 is NOT listed at the time of writing; monitor for future inclusion).

Threat Actor Campaign Information: No known threat actor campaigns or exploit-in-the-wild evidence exist for CVE-2026-16601 at the time of writing. The absence of PoC/exploit code suggests this is a newly disclosed or low-visibility issue; however, the vulnerability class (CWE-434 with exposed nonce) is a known and frequently weaponized pattern in WordPress ecosystems, so opportunistic exploitation is likely within 30–60 days post-disclosure. SOC teams should prioritize detection rule deployment ahead of any public exploit release.