High · published February 3, 2026
⚡ An authenticated attacker can upload any file they like! The OS DataHub Maps plugin in WordPress has a file validation flaw that lets them slip through the cracks — it's like allowing a delivery person to drop off anything without checking the package! 📦 Think of this vulnerability as a restaurant that lets delivery drivers bring in any ingredient without verifying it first. Just like a surprise ingredient could ruin your meal, an arbitrary file upload could compromise your website's security. If exploited, this could lead an attacker to upload malicious scripts or executables, potentially enabling remote code execution. That’s right, they could gain full control over your site and wreak absolute havoc! 🚨
Think of this vulnerability as a restaurant that lets delivery drivers bring in any ingredient without verifying it first. Just like a surprise ingredient could ruin your meal, an arbitrary file upload could compromise your website's security. The vulnerability stems from the 'add_file_and_ext' function in the OS DataHub Maps plugin, which fails to properly validate file types during uploads. This allows authenticated users with Author-level access or better to upload any file, including potentially harmful ones.
If exploited, this could lead an attacker to upload malicious scripts or executables, potentially enabling remote code execution. That’s right, they could gain full control over your site and wreak absolute havoc! 🚨 To protect your site, update the OS DataHub Maps plugin to version 1.8.4 or higher immediately. Additionally, review your user roles and permissions to limit who can upload files. Regularly check for plugin updates to stay secure! You've got this! Fixing this vulnerability is straightforward, so let's keep that website secure! 🛡️