Skip to content
CVE PROGRAM SOURCE RECORD5.3 Medium

CVE-2026-0593

WP Go Maps (formerly WP Google Maps) <= 10.0.04 - Missing Authorization to Authenticated (Subscriber+) Map Engine Setting Modification

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
Wordfence

Description

The WP Go Maps (formerly WP Google Maps) plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the processBackgroundAction() function in all versions up to, and including, 10.0.04. This makes it possible for authenticated attackers, with Subscriber-level access and above, to modify global map engine settings.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

wpgmaps WP Go Maps (formerly WP Google Maps)

Default version status: unaffected

  • 0 to ≤ 10.0.04affected

References