### [CVE-2022-0537](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-0537)
![](https://img.shields.io/static/v1?label=Product&message=MapPress%20Maps%20for%20WordPress&color=blue)
![](https://img.shields.io/static/v1?label=Version&message=2.73.13%3C%202.73.13%20&color=brighgreen)
![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-434%20Unrestricted%20Upload%20of%20File%20with%20Dangerous%20Type&color=brighgreen)

### Description

The MapPress Maps for WordPress plugin before 2.73.13 allows a high privileged user to bypass the DISALLOW_FILE_EDIT and DISALLOW_FILE_MODS settings and upload arbitrary files to the site through the "ajax_save" function. The file is written relative to the current 's stylesheet directory, and a .php file extension is added. No validation is performed on the content of the file, triggering an RCE vulnerability by uploading a web shell. Further the name parameter is not sanitized, allowing the payload to be uploaded to any directory to which the server has write access.

### POC

#### Reference
- https://wpscan.com/vulnerability/abfbba70-5158-4990-98e5-f302361db367
- https://wpscan.com/vulnerability/abfbba70-5158-4990-98e5-f302361db367

#### Github
No PoCs found on GitHub currently.