What is the CVSS score of CVE-2026-3581?

CVE-2026-3581 has a CVSS 3.1 base score of 5.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N. EPSS exploitation probability: 0.0%.

WordPress CVE-2026-3581

EUVD-2026-23180 MEDIUM

Missing Authorization (CWE-862)

2026-04-16 Wordfence

Authentication Bypass WordPress Google

5.3

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

5.3 MEDIUM

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Apr 16, 2026 - 06:01 vuln.today

EUVD ID Assigned

Apr 16, 2026 - 05:45 euvd

EUVD-2026-23180

Analysis Generated

Apr 16, 2026 - 05:45 vuln.today

CVE Published

Apr 16, 2026 - 05:29 nvd

MEDIUM 5.3

DescriptionCVE.org

The Basic Google Maps Placemarks plugin for WordPress is vulnerable to authorization bypass in versions up to, and including, 1.10.7. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated attackers to modify stored map latitude and longitude options.

AnalysisAI

Unauthenticated attackers can modify stored map latitude and longitude options in the Basic Google Maps Placemarks WordPress plugin through version 1.10.7 due to missing authorization checks on administrative functions. The vulnerability allows remote, unauthenticated modification of critical map configuration without requiring user interaction, affecting any WordPress site running the vulnerable plugin with default settings. No public exploit code or active exploitation has been identified at the time of analysis.

Technical ContextAI

The Basic Google Maps Placemarks plugin for WordPress implements map functionality but fails to enforce proper capability checks (via wp_verify_nonce and current_user_can functions) on endpoints that modify map latitude and longitude options. This is a classic authorization bypass (CWE-862: Missing Authorization) affecting WordPress plugin REST API or AJAX endpoints. The vulnerability exists in the plugin's option-update handlers, which should verify user authentication and WordPress nonce tokens before processing any administrative changes. WordPress typically stores plugin options in the wp_options table with serialized data; an authorization bypass allows direct modification of these geolocation parameters, potentially redirecting users to incorrect map locations or disrupting the intended map display.

RemediationAI

Update the Basic Google Maps Placemarks plugin to a version after 1.10.7 immediately; consult the WordPress plugin repository or vendor advisory for the exact patched version. The fix was committed to changeset 3495944 in the official plugin repository (https://plugins.trac.wordpress.org/changeset/3495944/basic-google-maps-placemarks), so upgrade to the first release incorporating that changeset. If an immediate update is not possible, consider disabling the Basic Google Maps Placemarks plugin entirely until a patched version is available and tested in your staging environment. Additionally, review WordPress user roles and capabilities to ensure only administrators and verified content managers have write access to critical site options; implement Web Application Firewall (WAF) rules to block suspicious POST/AJAX requests to plugin endpoints lacking proper nonce tokens (though this is a workaround, not a substitute for patching). Monitor WordPress audit logs for unauthorized option modifications, particularly changes to map latitude and longitude values.