Live › vulnerability › CVE-2026-19798
Go to dashboardThe Wp Map Block plugin up to and including 3.0.0 has a REST endpoint that checks only for edit_posts capability and does not verify ownership, so any logged-in Contributor can change the status of any map post. An attacker can hide published maps site-wide or publish draft maps, and the bulk action can delete maps owned by administrators.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Sites running the Wp Map Block plugin at version 3.0.0 or earlier where users with Contributor role or above exist, including sites where contributors can self-register or where untrusted authors have accounts. Sites without this plugin or with only trusted editors and administrators face lower risk.
No product ranges from the sources yet.
wp plugin get wp-map-block --field=version (plugin slug assumed; confirm it)3.0.0 once a patched release is available; the sources do not name a fixed versionEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
The Wp Map Block plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the set_status() and bulk() functions in the Maps_Controller REST controller in versions up to, and including, 3.0.0. The plugin's permission_callback (can_edit()) only verifies current_user_can('edit_posts') and performs no object-level ownership check or verification of publish-level capabilities, while the handlers pass the caller-controlled map ID directly to wp_update_post() (and wp_delete_post() in the bulk delete branch) to change post_status between publish and draft. This makes it possible for authenticated attackers, with Contributor-level access and above, to publish or unpublish (and bulk-delete) any wpmb_map post, including maps owned by administrators, which hides published maps from all public pages site-wide or forces draft maps to become publicly visible.
This page as .md · .json · in your agent: get_signal("CVE-2026-19798")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.