---
id: "CVE-2026-19798"
kind: "vulnerability"
aliases: ["CVE-2026-19798"]
title: "WordPress Map Block plugin lets contributors publish, unpublish and delete any map"
severity: "medium"
cvss: 4.3
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["package", "self-hosted", "wordpress", "wp-map-block"]
not_affected_if: ["no-contributor-accounts", "patched-version", "plugin-not-installed"]
published_at: "2026-10-16T07:17:13+00:00"
first_seen_at: "2026-10-23T21:57:12+00:00"
updated_at: "2026-10-25T04:41:13+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-19798", "first_seen_at": "2026-10-23T21:57:12+00:00"}]
---

# WordPress Map Block plugin lets contributors publish, unpublish and delete any map

The Wp Map Block plugin up to and including 3.0.0 has a REST endpoint that checks only for edit_posts capability and does not verify ownership, so any logged-in Contributor can change the status of any map post. An attacker can hide published maps site-wide or publish draft maps, and the bulk action can delete maps owned by administrators.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed version of the Wp Map Block plugin in the WordPress admin plugins list or with `wp plugin get wp-map-block --field=version` (plugin slug assumed; confirm it)
- Review which users have the Contributor role or higher and whether they can register or log in

## Fix

- Update the Wp Map Block plugin to a version later than `3.0.0` once a patched release is available; the sources do not name a fixed version
- Until patched, deactivate the plugin or restrict contributor-level accounts

## Timeline

- 2026-10-23T21:57:12+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-19798

## From the sources

The Wp Map Block plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the set_status() and bulk() functions in the Maps_Controller REST controller in versions up to, and including, 3.0.0. The plugin's permission_callback (can_edit()) only verifies current_user_can('edit_posts') and performs no object-level ownership check or verification of publish-level capabilities, while the handlers pass the caller-controlled map ID directly to wp_update_post() (and wp_delete_post() in the bulk delete branch) to change post_status between publish and draft. This makes it possible for authenticated attackers, with Contributor-level access and above, to publish or unpublish (and bulk-delete) any wpmb_map post, including maps owned by administrators, which hides published maps from all public pages site-wide or forces draft maps to become publicly visible.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_