CVE-2026-7552
5.3 MEDIUMThe Geo Mashup plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 1.13.19
Published: 2026-05-28 · Last updated: 2026-05-28
Severity and scoring
- CVSS
- 5.3 MEDIUM
- Vector
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
- CWE
- CWE-862
Description
The Geo Mashup plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 1.13.19. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated attackers to expose sensitive plugin configuration data, including Google Maps API keys and GeoNames service credentials, to unauthenticated attackers.
Source: NVD
References
- [NVD]https://nvd.nist.gov/vuln/detail/CVE-2026-7552
- [Other]https://plugins.trac.wordpress.org/browser/geo-mashup/tags/1.13.18/geo-mashup.php#L1525
- [Other]https://plugins.trac.wordpress.org/browser/geo-mashup/tags/1.13.18/geo-mashup.php#L515
- [Other]https://plugins.trac.wordpress.org/browser/geo-mashup/tags/1.13.18/geo-mashup.php#L528
- [Other]https://plugins.trac.wordpress.org/browser/geo-mashup/tags/1.13.19/geo-mashup.php#L1525
- [Other]https://plugins.trac.wordpress.org/browser/geo-mashup/tags/1.13.19/geo-mashup.php#L515
- [Other]https://plugins.trac.wordpress.org/browser/geo-mashup/tags/1.13.19/geo-mashup.php#L528
- [Other]https://plugins.trac.wordpress.org/browser/geo-mashup/trunk/geo-mashup.php#L1525
- [Other]https://plugins.trac.wordpress.org/browser/geo-mashup/trunk/geo-mashup.php#L515
- [Other]https://plugins.trac.wordpress.org/browser/geo-mashup/trunk/geo-mashup.php#L528
- [Other]https://plugins.trac.wordpress.org/changeset/3503627/geo-mashup
- [Other]https://www.wordfence.com/threat-intel/vulnerabilities/id/605dc24c-5b6e-479b-98dd-ad80c547824c?source=cve
Related CVEs
Same CWE
- CVE-2026-6964 — The Video Conferencing with Zoom plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 4.6.7 (5.3 MEDIUM)
- CVE-2026-49775 — Unauthenticated Broken Access Control in Welcart e-Commerce <= 2.11.28 versions (6.5 MEDIUM)
- CVE-2026-49070 — Unauthenticated Broken Access Control in Knit Pay <= 9.4.0.0 versions (7.5 HIGH)
- CVE-2026-49065 — Unauthenticated Broken Access Control in Hippoo Mobile App for WooCommerce <= 1.9.5 versions (8.2 HIGH)
- CVE-2026-48887 — Unauthenticated Broken Access Control in JS Help Desk <= 3.0.9 versions (6.5 MEDIUM)