What is the CVSS score of CVE-2026-73377?

CVE-2026-73377 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N. EPSS exploitation probability: 0.3%.

Which versions of Ultimate Maps by Supsystic are affected by CVE-2026-73377?

The Ultimate Maps by Supsystic WordPress plugin contains a critical security flaw that lets any internet user perform administrative actions on WordPress sites running the plugin.. A patch is available.

How to fix or mitigate CVE-2026-73377?

Within 24 hours, deactivate the Ultimate Maps by Supsystic plugin across all WordPress installations to prevent exploitation. Within 7 days, either uninstall the plugin completely and implement an alternative mapping solution, or defer action pending vendor release of a patched version. Within 30 days, audit administrative activity logs covering the exposure period to identify any unauthorized changes, remediate compromised configurations, and verify that replacement mapping plugins do not introduce similar authorization flaws.

Ultimate Maps by Supsystic CVE-2026-73377

EUVD-2026-60792 HIGH

Missing Authorization (CWE-862)

2026-08-18 Patchstack

GHSA-m9gp-f634-3ppc

WordPress Authentication Bypass Wordpress Plugin Ultimate Maps By Supsystic Supsystic

7.5

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

vuln.today AI

7.5 HIGH

Network-exposed WordPress AJAX endpoint requires no credentials (PR:N); integrity-only impact on plugin map data yields I:H with C:N and A:N, consistent with CWE-862 scope.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

High

Availability

None

Lifecycle Timeline

Patch available

Aug 18, 2026 - 15:02 EUVD

Analysis Generated

Aug 18, 2026 - 14:59 vuln.today

CVE Published

Aug 18, 2026 - 14:00 cve.org

HIGH 7.5

DescriptionCVE.org

Unauthenticated Broken Access Control in Ultimate Maps by Supsystic < 1.5.0 versions.

AnalysisAI

Broken access control in the Ultimate Maps by Supsystic WordPress plugin (all versions prior to 1.5.0) allows unauthenticated remote attackers to perform privileged administrative actions without any credentials. The flaw stems from missing authorization checks (CWE-862), meaning the plugin executes sensitive operations without validating the requester's identity or permission level. With a CVSS 3.1 score of 7.5 and an attack vector of network/no-privileges-required, exploitation is trivially achievable against any WordPress site running the affected plugin; no public exploit or CISA KEV listing has been identified at time of analysis.

Technical ContextAI

The affected component is the Ultimate Maps by Supsystic WordPress plugin, identified by CPE cpe:2.3:a:supsystic:ultimate_maps_by_supsystic:*:*:*:*:*:*:*:*. The root cause is CWE-862 (Missing Authorization), a class of flaws where application code exposes AJAX handlers, REST API endpoints, or admin-page callbacks without checking whether the calling user holds the required WordPress capability (e.g., manage_options or edit_posts). In WordPress plugin architecture this commonly occurs when wp_ajax_nopriv_ hooks - which are accessible to unauthenticated visitors - are registered for operations that should be gated behind capability checks such as current_user_can(). Because WordPress does not enforce authorization automatically, each plugin must implement its own checks; their absence leaves privileged actions exposed to any network-reachable visitor.

RemediationAI

Update the Ultimate Maps by Supsystic plugin to version 1.5.0 or later, which resolves the missing authorization checks. The update is available through the standard WordPress plugin repository and can be applied from the WordPress admin dashboard under Plugins > Installed Plugins > Update. The Patchstack advisory at https://patchstack.com/database/wordpress/plugin/ultimate-maps-by-supsystic/vulnerability/wordpress-ultimate-maps-by-supsystic-plugin-1-5-0-broken-access-control-vulnerability confirms 1.5.0 as the remediated release. If immediate patching is not feasible, a compensating control is to deactivate the plugin entirely until the update can be applied, which eliminates the exposed endpoints at the cost of losing map functionality. Firewall rules that block unauthenticated POST requests to WordPress AJAX endpoints (wp-admin/admin-ajax.php) targeting this plugin's action parameters can also reduce exposure, but require knowledge of the specific action names involved and may interfere with legitimate front-end functionality.