{"id":"CVE-2026-115954","kind":"vulnerability","aliases":["CVE-2026-115954"],"related":[],"title":"Geo Mashup WordPress plugin: missing authorization check through 1.13.22","description":"Missing Authorization vulnerability in Dylan Kuhn  Geo Mashup geo-mashup allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects  Geo Mashup: from n/a through 1.13.22.","summary":"The Geo Mashup WordPress plugin by Dylan Kuhn has a missing authorization check, caused by incorrectly configured access control levels. The sources do not say what data or actions an attacker can reach through it.","severity":"medium","cvss":5.4,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["geo-mashup","package","wordpress"],"not_affected_if":["plugin-not-installed"],"how_to_check":"- Check the installed Geo Mashup plugin version in the WordPress admin plugins list or with `wp plugin get geo-mashup --field=version`\n- unknown for anything beyond the version","fix":"- Update Geo Mashup to a version later than `1.13.22`\n- unknown for a specific fixed version number","status":"open","published_at":"2026-10-26T11:16:36+00:00","first_seen_at":"2026-10-26T11:29:40+00:00","triaged_at":"2026-10-26T11:31:12+00:00","updated_at":"2026-10-26T11:31:12+00:00","category":"package","confidence":0.4,"triage":{"at":"2026-10-26T11:31:12Z","model":"claude-haiku-5-5","output":{"fix":"- Update Geo Mashup to a version later than `1.13.22`\n- unknown for a specific fixed version number","reach":"internet","title":"Geo Mashup WordPress plugin: missing authorization check through 1.13.22","impact":"medium","summary":"The Geo Mashup WordPress plugin by Dylan Kuhn has a missing authorization check, caused by incorrectly configured access control levels. The sources do not say what data or actions an attacker can reach through it.","category":"package","nicknames":[],"who_cares":["wordpress","geo-mashup"],"confidence":0.4,"needs_auth":"unknown","worst_case":"unknown access to plugin functions, exact impact not stated","analyst_note":"Find the NVD or Wordfence write-up to learn which plugin actions lack the check, what the attacker gets, and the fixed version.","how_to_check":"- Check the installed Geo Mashup plugin version in the WordPress admin plugins list or with `wp plugin get geo-mashup --field=version`\n- unknown for anything beyond the version","needs_analyst":true,"not_affected_if":["plugin-not-installed"],"who_is_affected":"Sites running the Geo Mashup plugin at version `1.13.22` or earlier are affected. The sources do not say which configurations or roles make a site exposed, so unknown. Sites that do not run the plugin can skip it.","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000591,"input_tokens":3320,"output_tokens":517,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-115954':12A,15A '-2026':11A,14A '1.13.22':9A,80C 'access':38B,69C 'action':49B 'affect':74C 'allow':65C 'attack':51B 'author':6A,32B,55C 'caus':34B 'check':7A,33B 'configur':37B,68C 'control':39B,70C 'cve':10A,13A 'data':47B 'dylan':27B,58C 'exploit':66C 'geo':1A,17B,22B,60C,63C,75C 'geo-mashup':16B,62C 'incorrect':36B,67C 'issu':73C 'kuhn':28B,59C 'level':40B 'levels.this':72C 'mashup':2A,18B,23B,61C,64C,76C 'miss':5A,31B,54C 'n/a':78C 'packag':19B 'plugin':4A,25B 'reach':53B 'say':45B 'secur':71C 'sourc':42B 'vulner':56C 'wordpress':3A,20B,24B","nicknames":[],"mitigations":[],"who_affected":"Sites running the Geo Mashup plugin at version `1.13.22` or earlier are affected. The sources do not say which configurations or roles make a site exposed, so unknown. Sites that do not run the plugin can skip it.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-26T11:16:36+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N","cvss_by":"audit@patchstack.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-115954","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-115954","severity":null,"published_at":"2026-10-26T11:16:36+00:00","modified_at":"2026-10-26T11:16:36+00:00","first_seen_at":"2026-10-26T11:29:40+00:00","fetched_at":"2026-10-26T11:29:40+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}