Wp Map Block CVE-2026-19798

Requires an authenticated WordPress account with Contributor-level capability or higher (the vulnerable permission_callback can_edit() checks only current_user_can('edit_posts')), and the Wp Map Block plugin version 3.0.0 or earlier installed and active. Exploitation is limited to flipping post_status and bulk-deleting wpmb_map posts; it does not grant code execution. The key limiting factor is that sites which do not provision Contributor or higher roles to untrusted users are not realistically exposed - single-admin installations face little practical risk, whereas multi-author, membership, or guest-contributor sites are directly exposed because any such account can target maps owned by any user including administrators.

This is a genuine but comparatively low-priority issue - a medium-severity broken-access-control flaw (CVSS 4.3) rather than a critical compromise. The CVSS vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N correctly reflects the reality: network-reachable, low complexity, no user interaction, but requiring authenticated access at Contributor level or above (PR:L), with only limited integrity impact and no confidentiality or availability impact scored. No EPSS score was provided in the input and no exploitation-probability signal is available. There is no CISA KEV listing and no public POC referenced, so exploitation status is 'no public exploit identified at time of analysis'. The practical ceiling on impact is notable: an attacker can flip wpmb_map post_status between publish and draft and bulk-delete maps, which is a data-integrity/content-tampering and defacement-style problem rather than code execution or data theft. The required Contributor-level authentication is a meaningful limiting factor that keeps this well below the risk of an unauthenticated RCE, though multi-author/membership sites where untrusted users hold Contributor roles face higher relevance. One signal worth noting for the vendor/analyst: the scored impact is I:L/C:N/A:N, yet the description states draft maps can be forced publicly visible (a confidentiality angle) and maps can be bulk-deleted (an availability/integrity angle), so the real impact arguably spans more than integrity alone - verify impact scoping with Wordfence.

On a WordPress site that allows Contributor-level accounts (e.g. a multi-author blog or membership site), a low-privileged authenticated user sends a crafted REST request to the Wp Map Block Maps_Controller set_status() or bulk() endpoint referencing a map ID they do not own - such as an administrator's published map. Because the permission_callback only checks edit_posts and performs no ownership or publish-capability check, the handler passes the attacker-controlled ID straight to wp_update_post()/wp_delete_post(), letting them unpublish and hide live maps site-wide, publish others' drafts, or bulk-delete maps. No public exploit code is identified at time of analysis, and exploitation requires valid authenticated access.