Geo Mashup EUVD-2026-109725

Exploitation requires an authenticated account on the target WordPress site: the CVSS vector specifies PR:L, so a low-privileged user (such as a subscriber-level account) must already exist or be obtainable on the site. The flaw is a missing/misconfigured authorization check on a Geo Mashup plugin function, so the plugin must be installed and active at version 1.13.22 or earlier. No user interaction is needed (UI:N) and the request is made over the network (AV:N) with low attack complexity (AC:L). The principal limiting factors are the requirement for valid low-level authentication and the capped impact (low confidentiality and integrity only, no availability effect); the exact vulnerable function and whether any non-default configuration is required are not described in the available sources.

This is a moderate-severity Missing Authorization flaw (CWE-862) in the Geo Mashup WordPress plugin, rated CVSS 5.4 with vector AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N. The vector indicates network-reachable, low-complexity exploitation that requires low-level privileges (PR:L) - meaning an authenticated but unprivileged account (typical of WordPress broken-access-control plugin flaws, e.g. a subscriber or contributor) is needed, not a fully unauthenticated attacker; no user interaction is required. Impact is limited: low confidentiality and low integrity, with no availability impact, consistent with unauthorized access to or modification of some plugin-controlled data rather than full compromise. No EPSS score was supplied, the CVE is NOT on CISA KEV, and no confirmed public exploit code was provided (only a Patchstack database reference). The vuln.today decision label is 'this_month', indicating a routine remediation priority rather than an emergency. On balance this is a real but low-urgency issue: the authentication requirement (PR:L), capped low/low/none impact, and absence of active-exploitation signals place it well below critical-priority, high-CVSS items. There is no conflict between the CVSS vector and the description - both point to an authenticated, network-based access-control weakness.

An attacker who holds a low-privileged authenticated account on a WordPress site running Geo Mashup (version 1.13.22 or earlier) sends a crafted request to a plugin action that fails to properly check the caller's authorization level. Because the access-control check is missing or misconfigured, the attacker reads or alters plugin-managed data they should not be able to access. No public, verified exploit code was provided - only a Patchstack advisory reference exists.