EUVD-2026-23180Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
Lifecycle Timeline
4DescriptionCVE.org
The Basic Google Maps Placemarks plugin for WordPress is vulnerable to authorization bypass in versions up to, and including, 1.10.7. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated attackers to modify stored map latitude and longitude options.
AnalysisAI
Unauthenticated attackers can modify stored map latitude and longitude options in the Basic Google Maps Placemarks WordPress plugin through version 1.10.7 due to missing authorization checks on administrative functions. The vulnerability allows remote, unauthenticated modification of critical map configuration without requiring user interaction, affecting any WordPress site running the vulnerable plugin with default settings. No public exploit code or active exploitation has been identified at the time of analysis.
Technical ContextAI
The Basic Google Maps Placemarks plugin for WordPress implements map functionality but fails to enforce proper capability checks (via wp_verify_nonce and current_user_can functions) on endpoints that modify map latitude and longitude options. This is a classic authorization bypass (CWE-862: Missing Authorization) affecting WordPress plugin REST API or AJAX endpoints. The vulnerability exists in the plugin's option-update handlers, which should verify user authentication and WordPress nonce tokens before processing any administrative changes. WordPress typically stores plugin options in the wp_options table with serialized data; an authorization bypass allows direct modification of these geolocation parameters, potentially redirecting users to incorrect map locations or disrupting the intended map display.
RemediationAI
Update the Basic Google Maps Placemarks plugin to a version after 1.10.7 immediately; consult the WordPress plugin repository or vendor advisory for the exact patched version. The fix was committed to changeset 3495944 in the official plugin repository (https://plugins.trac.wordpress.org/changeset/3495944/basic-google-maps-placemarks), so upgrade to the first release incorporating that changeset. If an immediate update is not possible, consider disabling the Basic Google Maps Placemarks plugin entirely until a patched version is available and tested in your staging environment. Additionally, review WordPress user roles and capabilities to ensure only administrators and verified content managers have write access to critical site options; implement Web Application Firewall (WAF) rules to block suspicious POST/AJAX requests to plugin endpoints lacking proper nonce tokens (though this is a workaround, not a substitute for patching). Monitor WordPress audit logs for unauthorized option modifications, particularly changes to map latitude and longitude values.
Same weakness CWE-862 – Missing Authorization
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today