EUVD-2026-60792
GHSA-m9gp-f634-3ppc
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Network-exposed WordPress AJAX endpoint requires no credentials (PR:N); integrity-only impact on plugin map data yields I:H with C:N and A:N, consistent with CWE-862 scope.
Primary rating from Vendor (Patchstack).
CVSS VectorVendor: Patchstack
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Lifecycle Timeline
3DescriptionCVE.org
Unauthenticated Broken Access Control in Ultimate Maps by Supsystic < 1.5.0 versions.
AnalysisAI
Broken access control in the Ultimate Maps by Supsystic WordPress plugin (all versions prior to 1.5.0) allows unauthenticated remote attackers to perform privileged administrative actions without any credentials. The flaw stems from missing authorization checks (CWE-862), meaning the plugin executes sensitive operations without validating the requester's identity or permission level. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | The WordPress site must have the Ultimate Maps by Supsystic plugin installed and active in a version strictly below 1.5.0. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N) signals a high-severity, low-friction integrity threat: exploitation requires no authentication, no special configuration, and no user interaction, making it automatable at scale against any exposed WordPress installation. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An unauthenticated attacker identifies a WordPress site running Ultimate Maps by Supsystic below version 1.5.0 - detectable via publicly visible plugin file paths or version metadata. The attacker sends a crafted HTTP POST request directly to the WordPress AJAX endpoint (wp-admin/admin-ajax.php) invoking a privileged plugin action without supplying authentication cookies or nonces. … |
| Remediation | Update the Ultimate Maps by Supsystic plugin to version 1.5.0 or later, which resolves the missing authorization checks. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, deactivate the Ultimate Maps by Supsystic plugin across all WordPress installations to prevent exploitation. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Ultimate Maps By Supsystic
View allUnauthenticated PHP Object Injection in the Ultimate Maps by Supsystic WordPress plugin (all versions before 1.5.0) lets
Unauthenticated Cross-Site Scripting in the Ultimate Maps by Supsystic WordPress plugin (all versions prior to 1.5.0) al
Same weakness CWE-862 – Missing Authorization
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today