Answer in brief
CVE-2026-16601 records a High severity (CVSS 8.8) vulnerability in CM Map Locations <= 2.1.8 - Authenticated (Subscriber+) Arbitrary File Upload via cmloc_route_image_upload AJAX Action. The current sources do not mark it as known exploited. The current feed maps creativemindssolutions/CM Map Locations – Visualize and share your locations in a few clicks (generic), creativemindssolutions/CM Map Locations – Visualize and share your locations in a few clicks (generic). Check affected ranges and fixed versions before updating.
Analysis pending evidence review
HOL Guard separates source facts from reviewed analysis. See the methodology.
CVSS is 8.8. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.
Analysis status
Analysis pending evidence review
Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.
The current feed maps creativemindssolutions/CM Map Locations – Visualize and share your locations in a few clicks (generic), creativemindssolutions/CM Map Locations – Visualize and share your locations in a few clicks (generic). Check affected ranges and fixed versions before updating.
| Package | Affected range | Fixed version |
|---|---|---|
| creativemindssolutions/CM Map Locations – Visualize and share your locations in a few clicksgeneric | >=0 <=2.1.8 | Not reported |
| creativemindssolutions/CM Map Locations – Visualize and share your locations in a few clicksgeneric | 0 | Not reported |
Published upstream
Aug 25, 2026
Evidence: source:cvelist:source_dates:source-dates:recordSource modified
Aug 27, 2026
Evidence: source:cvelist:source_dates:source-dates:recordFirst seen by HOL
Aug 25, 2026
The CM Map Locations – Visualize and share your locations in a few clicks plugin for WordPress is vulnerable to Limited Arbitrary File Upload in all versions up to, and including, 2.1.8 via the uploadMedia function. This is due to insufficient file type validation in the upload handler, which performs incomplete extension filtering without MIME-type checks or upload capability verification before passing attacker-supplied files to move_uploaded_file(). This makes it possible for authenticated attackers, with subscriber-level access and above, to upload files that may be executable, which makes remote code execution possible. The required nonce is exposed to any logged-in Subscriber via the CMLOC_Editor_Images JavaScript object on the front-end location editor page.
Quoted source text, attributed separately from HOL analysis.