{"id":"CVE-2026-19798","kind":"vulnerability","aliases":["CVE-2026-19798"],"related":[],"title":"WordPress Map Block plugin lets contributors publish, unpublish and delete any map","description":"The Wp Map Block plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the set_status() and bulk() functions in the Maps_Controller REST controller in versions up to, and including, 3.0.0. The plugin's permission_callback (can_edit()) only verifies current_user_can('edit_posts') and performs no object-level ownership check or verification of publish-level capabilities, while the handlers pass the caller-controlled map ID directly to wp_update_post() (and wp_delete_post() in the bulk delete branch) to change post_status between publish and draft. This makes it possible for authenticated attackers, with Contributor-level access and above, to publish or unpublish (and bulk-delete) any wpmb_map post, including maps owned by administrators, which hides published maps from all public pages site-wide or forces draft maps to become publicly visible.","summary":"The Wp Map Block plugin up to and including 3.0.0 has a REST endpoint that checks only for edit_posts capability and does not verify ownership, so any logged-in Contributor can change the status of any map post. An attacker can hide published maps site-wide or publish draft maps, and the bulk action can delete maps owned by administrators.","severity":"medium","cvss":4.3,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["package","self-hosted","wordpress","wp-map-block"],"not_affected_if":["no-contributor-accounts","patched-version","plugin-not-installed"],"how_to_check":"- Check the installed version of the Wp Map Block plugin in the WordPress admin plugins list or with `wp plugin get wp-map-block --field=version` (plugin slug assumed; confirm it)\n- Review which users have the Contributor role or higher and whether they can register or log in","fix":"- Update the Wp Map Block plugin to a version later than `3.0.0` once a patched release is available; the sources do not name a fixed version\n- Until patched, deactivate the plugin or restrict contributor-level accounts","status":"open","published_at":"2026-10-16T07:17:13+00:00","first_seen_at":"2026-10-23T21:57:12+00:00","triaged_at":"2026-10-25T04:41:13+00:00","updated_at":"2026-10-25T04:41:13+00:00","category":"package","confidence":0.8,"triage":{"at":"2026-10-25T04:41:13Z","model":"claude-haiku-5-5","output":{"fix":"- Update the Wp Map Block plugin to a version later than `3.0.0` once a patched release is available; the sources do not name a fixed version\n- Until patched, deactivate the plugin or restrict contributor-level accounts","reach":"internet","title":"WordPress Map Block plugin lets contributors publish, unpublish and delete any map","impact":"medium","summary":"The Wp Map Block plugin up to and including 3.0.0 has a REST endpoint that checks only for edit_posts capability and does not verify ownership, so any logged-in Contributor can change the status of any map post. An attacker can hide published maps site-wide or publish draft maps, and the bulk action can delete maps owned by administrators.","category":"package","nicknames":[],"who_cares":["wordpress","wp-map-block","self-hosted"],"confidence":0.8,"needs_auth":"yes","worst_case":"Contributors can unpublish, publish or delete other users' map posts","analyst_note":"","how_to_check":"- Check the installed version of the Wp Map Block plugin in the WordPress admin plugins list or with `wp plugin get wp-map-block --field=version` (plugin slug assumed; confirm it)\n- Review which users have the Contributor role or higher and whether they can register or log in","needs_analyst":false,"not_affected_if":["plugin-not-installed","no-contributor-accounts","patched-version"],"who_is_affected":"Sites running the Wp Map Block plugin at version 3.0.0 or earlier where users with Contributor role or above exist, including sites where contributors can self-register or where untrusted authors have accounts. Sites without this plugin or with only trusted editors and administrators face lower risk.","user_interaction":"no","needs_special_setup":"no","severity_if_unknown":"medium"},"cost_usd":0.000658,"input_tokens":3510,"output_tokens":614,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-19798':15A,18A '-2026':14A,17A '3.0.0':37B,130C 'access':203C 'action':84B 'administr':90B,222C 'attack':69B,198C 'authent':197C 'becom':239C 'block':3A,27B,31B,94C 'branch':183C 'bulk':83B,116C,181C,212C 'bulk-delet':211C 'callback':135C 'caller':166C 'caller-control':165C 'capabl':48B,109C,159C 'chang':61B,185C 'check':43B,110C,152C 'contributor':6A,59B,201C 'contributor-level':200C 'control':121C,123C,167C 'current':140C 'cve':13A,16A 'data':104C 'delet':10A,86B,177C,182C,213C 'direct':170C 'draft':79B,191C,236C 'due':105C 'edit':46B,137C,143C 'endpoint':41B 'forc':235C 'function':117C 'handler':162C 'hide':71B,224C 'host':22B 'id':169C 'includ':36B,129C,218C 'let':5A 'level':150C,158C,202C 'log':57B 'logged-in':56B 'make':193C 'map':2A,12A,26B,30B,66B,73B,80B,87B,93C,120C,168C,216C,219C,226C,237C 'miss':108C 'modif':102C 'object':149C 'object-level':148C 'own':88B,220C 'ownership':53B,151C 'packag':19B 'page':230C 'pass':163C 'perform':146C 'permiss':134C 'plugin':4A,32B,95C,132C 'possibl':195C 'post':47B,67B,144C,174C,178C,186C,217C 'public':229C,240C 'publish':7A,72B,78B,157C,189C,207C,225C 'publish-level':156C 'rest':40B,122C 'self':21B 'self-host':20B 'set':113C 'site':75B,232C 'site-wid':74B,231C 'status':63B,114C,187C 'unauthor':101C 'unpublish':8A,209C 'updat':173C 'user':141C 'verif':154C 'verifi':52B,139C 'version':125C 'visibl':241C 'vulner':99C 'wide':76B,233C 'wordpress':1A,23B,97C 'wp':25B,29B,92C,172C,176C 'wp-map-block':24B 'wpmb':215C","nicknames":[],"mitigations":[],"who_affected":"Sites running the Wp Map Block plugin at version 3.0.0 or earlier where users with Contributor role or above exist, including sites where contributors can self-register or where untrusted authors have accounts. Sites without this plugin or with only trusted editors and administrators face lower risk.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-16T07:17:13+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N","cvss_by":"security@wordfence.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-19798","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-19798","severity":null,"published_at":"2026-10-16T07:17:13+00:00","modified_at":"2026-10-16T15:17:15+00:00","first_seen_at":"2026-10-23T21:57:12+00:00","fetched_at":"2026-10-23T22:28:55+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}