CVE-2020-12675: 
WordPress vulnerability analysis and mitigation

The MapPress Maps for WordPress plugin before version 2.54.6 contained a vulnerability (CVE-2020-12675) that was discovered by Alert Logic's Threat Research team. The plugin, which had over 80,000 installations, allowed attackers with subscriber privileges to download or delete arbitrary PHP files or upload malicious PHP files to vulnerable sites (Alert Logic Blog).

The vulnerability stemmed from incorrect implementation of capability checks for AJAX functions in the plugin. This security flaw could potentially lead to remote command execution on affected sites. The vulnerability was assigned a CVSS score of 8.8, indicating a high severity level (CISA Bulletin).

If exploited, the vulnerability could allow an attacker with subscriber-level access to perform unauthorized file operations, including downloading or deleting arbitrary PHP files, and uploading malicious PHP files. This could ultimately result in remote command execution on vulnerable WordPress sites (Alert Logic Blog).

The vulnerability required an attacker to have subscriber privileges on the WordPress site. This was an incomplete fix for a previous vulnerability (CVE-2020-12077), suggesting that the initial patch was insufficient in addressing the security concerns (CISA Bulletin).

The vulnerability was patched in MapPress version 2.54.6. Site administrators using affected versions were strongly recommended to update to version 2.54.6 or newer to remediate this vulnerability. The MapPress development team worked quickly with Alert Logic to resolve the underlying vulnerability (Alert Logic Blog).