{"id":"CVE-2026-123475","kind":"vulnerability","aliases":["CVE-2026-123475"],"related":[],"title":"MapSVG Lite WordPress map plugin: missing authorization lets unauthorized users act","description":"Missing Authorization vulnerability in PT Norther Lights Production MapSVG mapsvg-lite-interactive-vector-maps allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects MapSVG: from n/a through 8.16.3.","summary":"MapSVG Lite, an interactive vector map plugin for WordPress, has a missing authorization check in versions through 8.16.3. The sources say an attacker can exploit incorrectly configured access control to reach functions they should not.","severity":"high","cvss":7.5,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"mapsvg-lite-interactive-vector-maps","fixed":[],"affected":"<= 8.16.3","ecosystem":"wordpress"}],"ecosystems":[],"tags":["mapsvg","package","wordpress","wordpress-plugin"],"not_affected_if":["plugin-not-installed"],"how_to_check":"In WordPress admin > Plugins, check the MapSVG Lite version; versions 8.16.3 and older are in the affected range per the triage/NVD summary. Or read the Version header in the plugin's main PHP file under wp-content/plugins/.","fix":null,"status":"open","published_at":"2026-11-09T11:17:23+00:00","first_seen_at":"2026-11-09T11:26:03+00:00","triaged_at":"2026-11-09T11:26:28+00:00","updated_at":"2026-11-09T11:28:09+00:00","category":"package","confidence":0.4,"triage":{"at":"2026-11-09T11:26:28Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"MapSVG Lite WordPress map plugin: missing authorization lets unauthorized users act","impact":"medium","summary":"MapSVG Lite, an interactive vector map plugin for WordPress, has a missing authorization check in versions through 8.16.3. The sources say an attacker can exploit incorrectly configured access control to reach functions they should not.","audience":"businesses","category":"package","nicknames":[],"who_cares":["wordpress","mapsvg"],"confidence":0.5,"fix_status":"unknown","needs_auth":"unknown","worst_case":"unauthorized users may perform actions the plugin should restrict","analyst_note":"Find the vendor advisory or the patched version and the affected endpoints at https://nvd.nist.gov/vuln/detail/CVE-2026-123475.","how_to_check":"- Check the installed MapSVG Lite plugin version in the WordPress admin plugins list or the plugin's main file header.\n- Confirm whether the installed version is `8.16.3` or older.","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["plugin-not-installed"],"who_is_affected":"Sites running the MapSVG Lite plugin at version 8.16.3 or earlier are in scope according to the NVD description. The sources do not describe the exact endpoints or required roles, so whether a site without special setup is exposed is unknown.","user_interaction":"unknown","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000727,"input_tokens":4557,"output_tokens":543,"severity_before":"high"},"analyst_status":"done","analyst_note":"Find the vendor advisory or the patched version and the affected endpoints at https://nvd.nist.gov/vuln/detail/CVE-2026-123475.","search":"'-123475':14A,17A '-2026':13A,16A '8.16.3':47B,91C 'access':57B,81C 'act':11A 'affect':86C 'allow':77C 'attack':52B 'author':7A,42B,63C 'check':43B 'configur':56B,80C 'control':58B,82C 'cve':12A,15A 'exploit':54B,78C 'function':61B 'incorrect':55B,79C 'interact':33B,74C 'interactive':21A 'issu':85C 'let':8A 'levels.this':84C 'light':68C 'lite':2A,20A,31B,73C 'map':4A,35B,76C 'maps':23A 'mapsvg':1A,19A,24B,30B,70C,72C,87C 'mapsvg-lite-interactive-vector-map':71C 'mapsvg-lite-interactive-vector-maps':18A 'miss':6A,41B,62C 'n/a':89C 'norther':67C 'packag':25B 'plugin':5A,29B,36B 'product':69C 'pt':66C 'reach':60B 'say':50B 'secur':83C 'sourc':49B 'unauthor':9A 'user':10A 'vector':22A,34B,75C 'version':45B 'vulner':64C 'wordpress':3A,26B,28B,38B 'wordpress-plugin':27B","nicknames":[],"mitigations":[],"who_affected":"Sites running the MapSVG Lite plugin at version 8.16.3 or earlier are in scope according to the NVD description. The sources do not describe the exact endpoints or required roles, so whether a site without special setup is exposed is unknown.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":["mapsvgliteinteractivevectormaps"],"ptokens":["interactive","lite","maps","mapsvg","vector"],"labels":["high","mapsvg","package","wordpress","wordpressplugin"],"campaign_type":null,"search_a":"'-123475':14A,17A '-2026':13A,16A 'act':11A 'author':7A 'cve':12A,15A 'interactive':21A 'let':8A 'lite':2A,20A 'map':4A 'maps':23A 'mapsvg':1A,19A 'mapsvg-lite-interactive-vector-maps':18A 'miss':6A 'plugin':5A 'unauthor':9A 'user':10A 'vector':22A 'wordpress':3A","search_b":"'8.16.3':47B 'access':57B 'attack':52B 'author':42B 'check':43B 'configur':56B 'control':58B 'exploit':54B 'function':61B 'incorrect':55B 'interact':33B 'lite':31B 'map':35B 'mapsvg':24B,30B 'miss':41B 'packag':25B 'plugin':29B,36B 'reach':60B 'say':50B 'sourc':49B 'vector':34B 'version':45B 'wordpress':26B,28B,38B 'wordpress-plugin':27B","search_c":"'8.16.3':91C 'access':81C 'affect':86C 'allow':77C 'author':63C 'configur':80C 'control':82C 'exploit':78C 'incorrect':79C 'interact':74C 'issu':85C 'levels.this':84C 'light':68C 'lite':73C 'map':76C 'mapsvg':70C,72C,87C 'mapsvg-lite-interactive-vector-map':71C 'miss':62C 'n/a':89C 'norther':67C 'product':69C 'pt':66C 'secur':83C 'vector':75C 'vulner':64C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-09T11:17:23+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","cvss_by":"audit@patchstack.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-123475","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-123475","severity":null,"published_at":"2026-11-09T11:17:23+00:00","modified_at":"2026-11-09T11:17:23+00:00","first_seen_at":"2026-11-09T11:26:03+00:00","fetched_at":"2026-11-09T11:26:03+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-123475:2274","url":"https://wordpress.org/plugins/mapsvg-lite-interactive-vector-maps/","severity":null,"published_at":"2026-11-09T11:28:09+00:00","modified_at":"2026-11-09T11:28:09+00:00","first_seen_at":"2026-11-09T11:28:09+00:00","fetched_at":"2026-11-09T11:28:09+00:00","note":"Partial. web-cli out of Exa credits (402); NVD page fetch returned no content. Only primary-ish page read: wordpress.org plugin page (current 9.0.2; changelog has no entry naming this CVE, so the exact fixed version is not confirmed). Fix left unknown, nothing verified. Affected range '<= 8.16.3' comes from triage/NVD summary, unconfirmed. Settle by reading the NVD/Wordfence/Patchstack entry or the plugin's changelog/trac diff after 8.16.3. No exploitation or PoC evidence found; X not searched.","cites":["https://wordpress.org/plugins/mapsvg-lite-interactive-vector-maps/"]}],"documents":[{"id":107192,"url":"https://wordpress.org/plugins/mapsvg-lite-interactive-vector-maps/","title":"MapSVG Lite plugin page and changelog (wordpress.org)","kind":"vendor","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"mentions","confidence":null,"note":null}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}