The vulnerability is exacerbated by the exposure of a required security nonce within the CMLOC_Editor_Images JavaScript object on the front-end location editor page. By obtaining this nonce, an authenticated subscriber can craft requests that bypass intended permission checks, leading to the upload of executable files to the server. Successful exploitation allows for remote code execution, posing a significant risk to site integrity and server security. Defenders should prioritize updating to the patched version of the plugin and auditing logs for unusual file uploads to the plugin media directories.

Attack Chain

1. Attacker authenticates as a user with subscriber-level privileges on the WordPress site.
2. Attacker navigates to the front-end location editor page provided by the CM Map Locations plugin.
3. Attacker extracts the required security nonce from the CMLOC_Editor_Images JavaScript object.
4. Attacker crafts a POST request to the uploadMedia handler using the extracted nonce.
5. Attacker includes a malicious payload (e.g., a PHP script) within the file upload request.
6. The plugin fails to validate the file extension or MIME-type, passing the file to move_uploaded_file().
7. The malicious file is written to the web-accessible file system.
8. Attacker requests the uploaded file directly via the browser to trigger remote code execution.

Impact

Successful exploitation of this vulnerability allows an unprivileged authenticated user to gain remote code execution on the WordPress server. This could lead to full site compromise, exfiltration of database contents, or use of the host server for further network attacks. Because the plugin is a common mapping solution, the potential blast radius includes any WordPress instance running version 2.1.8 or lower.

Recommendation

• Update the CM Map Locations plugin to the latest version immediately to remediate the vulnerable uploadMedia function.
• Audit the webserver access logs for anomalous POST requests to the plugin upload endpoints, specifically targeting non-image file extensions or suspicious file paths.
• Review WordPress user roles to ensure that subscriber accounts are necessary and do not have access to sensitive front-end editing features where these scripts are exposed.
• Implement file integrity monitoring on the WordPress uploads directory to detect unauthorized file creation by the web service user.