What is the CVSS score of CVE-2026-7552?

CVE-2026-7552 has a CVSS 3.1 base score of 5.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N. EPSS exploitation probability: 0.1%.

Geo Mashup CVE-2026-7552

EUVD-2026-32734 MEDIUM

Missing Authorization (CWE-862)

2026-05-28 Wordfence

GHSA-6335-2fw8-gmj8

Google WordPress Authentication Bypass

5.3

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

5.3 MEDIUM

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

May 28, 2026 - 07:54 vuln.today

CVE Published

May 28, 2026 - 06:45 nvd

MEDIUM 5.3

DescriptionCVE.org

The Geo Mashup plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 1.13.19. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated attackers to expose sensitive plugin configuration data, including Google Maps API keys and GeoNames service credentials, to unauthenticated attackers.

AnalysisAI

Authorization bypass in the Geo Mashup WordPress plugin (all versions ≤ 1.13.19) exposes sensitive plugin configuration data to unauthenticated remote attackers, including Google Maps API keys and GeoNames service credentials. The flaw (CWE-862 Missing Authorization) exists at specific request-handling code paths in geo-mashup.php (lines 515, 528, and 1525), where the plugin returns configuration data without verifying requester authorization. No public exploit code or CISA KEV listing exists at time of analysis, but the CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms this is trivially exploitable with no authentication, no complexity, and no user interaction required against any affected installation.

Technical ContextAI

Geo Mashup (vendor: cyberhobo, CPE: cpe:2.3:a:cyberhobo:geo_mashup:*:*:*:*:*:*:*:*) is a WordPress geolocation plugin that integrates Google Maps and GeoNames services, storing third-party API credentials in its configuration. CWE-862 (Missing Authorization) identifies the root cause: the plugin exposes request-handling logic - at geo-mashup.php lines 515, 528, and 1525, confirmed across both trunk and tagged releases 1.13.18 and 1.13.19 - without enforcing WordPress capability or nonce checks to verify that the requester is a legitimate authorized user. These endpoints likely handle AJAX callbacks or REST-style requests that return serialized plugin settings, including stored API keys. The vulnerability is distinct from authentication bypass (CWE-287); a user may be authenticated or not - the issue is that authorization is simply never checked at these code paths.

RemediationAI

An upstream fix has been committed to the WordPress plugin Trac repository as changeset 3503627 (https://plugins.trac.wordpress.org/changeset/3503627/geo-mashup); however, a specific released patched version number is not confirmed in the available data - this should be verified via the WordPress plugin repository before applying. Administrators should update the Geo Mashup plugin to the latest available version immediately via the WordPress admin dashboard or via wp-cli (wp plugin update geo-mashup). Critically, as a compensating control regardless of patch status, all exposed Google Maps API keys should be rotated immediately through the Google Cloud Console, and HTTP referrer restrictions or IP restrictions should be applied to the new keys to limit abuse surface. GeoNames credentials should similarly be rotated via the GeoNames account portal. If an immediate upgrade is not feasible, disabling the plugin entirely removes the vulnerable endpoints but also disables all geolocation functionality on the site - this trade-off should be assessed against the sensitivity of the stored credentials.