{"id":"CVE-2026-19798","aliases":["EUVD-2026-102795","GHSA-5899-9734-mqjw"],"status":"published","title":"WP Map Block \u003c= 3.0.0 - Missing Authorization to Authenticated (Contributor+) Arbitrary Map Publish/Unpublish/Delete via set_status() and bulk() REST Endpoints","description":"The Wp Map Block plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the set_status() and bulk() functions in the Maps_Controller REST controller in versions up to, and including, 3.0.0. The plugin's permission_callback (can_edit()) only verifies current_user_can('edit_posts') and performs no object-level ownership check or verification of publish-level capabilities, while the handlers pass the caller-controlled map ID directly to wp_update_post() (and wp_delete_post() in the bulk delete branch) to change post_status between publish and draft. This makes it possible for authenticated attackers, with Contributor-level access and above, to publish or unpublish (and bulk-delete) any wpmb_map post, including maps owned by administrators, which hides published maps from all public pages site-wide or forces draft maps to become publicly visible.","severity":{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-10","score":0.00204,"percentile":0.10419,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-862"],"published":"2026-10-16T06:41:05Z","modified":"2026-10-16T15:17:15Z","products":[{"vendor":"tusharimran","product":"wp map block – google maps, openstreetmap, mapbox, store \u0026 shop locator, directory, listings \u0026 filters"}],"references":[{"url":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b42f1f71-e272-48d4-9b3f-4360b287e16f?source=cve"},{"url":"https://plugins.trac.wordpress.org/browser/wp-map-block/tags/3.0.0/includes/Rest/Maps_Controller.php#L237"},{"url":"https://plugins.trac.wordpress.org/browser/wp-map-block/tags/3.0.0/includes/Rest/Maps_Controller.php#L262"},{"url":"https://plugins.trac.wordpress.org/browser/wp-map-block/tags/3.0.0/includes/Rest/Maps_Controller.php#L124"},{"url":"https://plugins.trac.wordpress.org/browser/wp-map-block/tags/3.0.0/includes/Rest/Maps_Controller.php#L63"},{"url":"https://plugins.trac.wordpress.org/changeset?reponame=\u0026old=3730836%40wp-map-block\u0026new=3730836%40wp-map-block"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-19798"},{"url":"https://github.com/advisories/GHSA-5899-9734-mqjw"}],"sources":{"cve":[{"id":"CVE-2026-19798","title":"WP Map Block \u003c= 3.0.0 - Missing Authorization to Authenticated (Contributor+) Arbitrary Map Publish/Unpublish/Delete via set_status() and bulk() REST Endpoints","description":"The Wp Map Block plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the set_status() and bulk() functions in the Maps_Controller REST controller in versions up to, and including, 3.0.0. The plugin's permission_callback (can_edit()) only verifies current_user_can('edit_posts') and performs no object-level ownership check or verification of publish-level capabilities, while the handlers pass the caller-controlled map ID directly to wp_update_post() (and wp_delete_post() in the bulk delete branch) to change post_status between publish and draft. This makes it possible for authenticated attackers, with Contributor-level access and above, to publish or unpublish (and bulk-delete) any wpmb_map post, including maps owned by administrators, which hides published maps from all public pages site-wide or forces draft maps to become publicly visible.","status":"published","published":"2026-10-16T06:41:05.739Z","modified":"2026-10-16T14:22:54.237Z","cvss":[{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N","level":"medium","assessor":"cna"}],"cwes":["CWE-862"],"updated_at":"2026-11-02T13:47:28.691429Z"}],"euvd":[{"id":"EUVD-2026-102795","description":"The Wp Map Block plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the set_status() and bulk() functions in the Maps_Controller REST controller in versions up to, and including, 3.0.0. The plugin's permission_callback (can_edit()) only verifies current_user_can('edit_posts') and performs no object-level ownership check or verification of publish-level capabilities, while the handlers pass the caller-controlled map ID directly to wp_update_post() (and wp_delete_post() in the bulk delete branch) to change post_status between publish and draft. This makes it possible for authenticated attackers, with Contributor-level access and above, to publish or unpublish (and bulk-delete) any wpmb_map post, including maps owned by administrators, which hides published maps from all public pages site-wide or forces draft maps to become publicly visible.","status":"published","published":"2026-10-16T06:41:05Z","modified":"2026-10-16T14:22:54Z","cvss":[{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T17:00:06.126239Z"}],"ghsa":[{"id":"GHSA-5899-9734-mqjw","title":"The Wp Map Block plugin for WordPress is vulnerable to unauthorized modification of data due to a...","description":"The Wp Map Block plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the set_status() and bulk() functions in the Maps_Controller REST controller in versions up to, and including, 3.0.0. The plugin's permission_callback (can_edit()) only verifies current_user_can('edit_posts') and performs no object-level ownership check or verification of publish-level capabilities, while the handlers pass the caller-controlled map ID directly to wp_update_post() (and wp_delete_post() in the bulk delete branch) to change post_status between publish and draft. This makes it possible for authenticated attackers, with Contributor-level access and above, to publish or unpublish (and bulk-delete) any wpmb_map post, including maps owned by administrators, which hides published maps from all public pages site-wide or forces draft maps to become publicly visible.","status":"published","published":"2026-10-16T09:30:28Z","modified":"2026-10-16T09:30:35Z","cvss":[{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N","level":"medium"}],"cwes":["CWE-862"],"updated_at":"2026-11-02T15:13:51.12467Z"}],"nvd":[{"id":"CVE-2026-19798","description":"The Wp Map Block plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the set_status() and bulk() functions in the Maps_Controller REST controller in versions up to, and including, 3.0.0. The plugin's permission_callback (can_edit()) only verifies current_user_can('edit_posts') and performs no object-level ownership check or verification of publish-level capabilities, while the handlers pass the caller-controlled map ID directly to wp_update_post() (and wp_delete_post() in the bulk delete branch) to change post_status between publish and draft. This makes it possible for authenticated attackers, with Contributor-level access and above, to publish or unpublish (and bulk-delete) any wpmb_map post, including maps owned by administrators, which hides published maps from all public pages site-wide or forces draft maps to become publicly visible.","status":"published","published":"2026-10-16T07:17:13.217Z","modified":"2026-10-16T15:17:15.747Z","cvss":[{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N","level":"medium","assessor":"secondary"}],"cwes":["CWE-862"],"updated_at":"2026-11-02T14:12:59.751798Z"}]}}