CodePeople Post Map CVE-2026-13335

Exploitation requires a valid WordPress user account at Contributor level or higher - unauthenticated attackers cannot exploit this vulnerability. The CodePeople Post Map for Google Maps plugin must be installed, active, and at version 1.2.6 or earlier. The attacker must have the capability to create or edit WordPress posts and set the 'cpm_point' post meta value, which is standard functionality available to Contributors. Exploitation is further limited by the requirement that a victim (ideally a privileged user such as an Editor or Administrator) must visit the page containing the injected map point for the payload to execute. Sites where Contributor-level access is restricted to fully trusted internal users, or where no Contributor-or-above accounts exist for external parties, face substantially lower realistic risk despite the network-accessible CVSS vector.

The CVSS 3.1 score of 6.4 (Medium) with vector AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N accurately reflects the key risk dynamics. The PR:L constraint is the primary limiting factor: exploitation is gated on possessing at minimum a WordPress Contributor-level account, which prevents unauthenticated remote exploitation. However, in multi-author WordPress environments - news sites, community blogs, CMS platforms with open contributor registration - this bar is frequently met by a large user population, making the effective attack surface substantially broader than a pure PR:H flaw. The S:C flag is significant: the injected script executes in the victim's browser context, enabling theft of session tokens or forced administrative actions if an admin visits the page, which is a realistic privilege-escalation path in WordPress. No EPSS score was provided in the available data, KEV listing is absent, and no POC code has been identified, suggesting this is not currently subject to broad automated exploitation. The WordPress SVN changeset reference indicates an upstream fix has been committed, reducing remediation friction. Real-world priority is moderate: highest for multi-author WordPress deployments with external contributor access; lower for single-author or tightly controlled sites.

An attacker registers or compromises a Contributor-level WordPress account on a target site running CodePeople Post Map for Google Maps 1.2.6 or earlier. The attacker creates a post embedding a Google Map and sets the 'cpm_point' meta field to a value containing a malicious JavaScript payload (e.g., a script that exfiltrates the visitor's session cookie to an attacker-controlled endpoint). When an administrator reviews or visits the published post, the stored script executes silently in their browser, delivering the admin session token to the attacker and enabling full site takeover. No public POC has been identified, but the technique is well-understood for WordPress stored XSS flaws of this class.