CVE-2021-24947: Thinkupthemes Responsive Vector Maps

Medium severity, CVSS 6.5. EPSS: 3.1% chance of exploitation in the next 30 days.

The RVM WordPress plugin before 6.4.2 does not have proper authorisation, CSRF checks and validation of the rvm_upload_regions_file_path parameter in the rvm_import_regions AJAX action, allowing any authenticated user, such as subscriber, to read arbitrary files on the web server

Affected products

• Thinkupthemes Responsive Vector Maps: before 6.4.2 (fixed in 6.4.2)

Published 2022-02-07. Last modified 2026-06-17.