WP Maps EUVD-2026-34959

Exploitation requires the attacker to be authenticated to the WordPress site and hold the wpgmp_manage_location capability, which is granted to administrators by default. This capability can be assigned to lower-privileged roles (e.g., editors, contributors) through the plugin's built-in Permissions screen - doing so effectively lowers the required privilege level below administrator. The CVSS vector confirms PR:H (high privileges required) and AC:H (high attack complexity), meaning exploitation is not straightforward even with the required access. Victims do not need to perform any action beyond loading a page containing the affected shortcode (UI:N on the attacker side, but passive browsing by victims is the delivery mechanism). Exploitation is limited by: the requirement for a valid authenticated session with the specific capability, the AC:H complexity factor suggesting non-trivial triggering conditions, the need for at least one victim to visit an injected page, and the absence of a default configuration that automatically exposes lower-privileged users to this capability.

The CVSS base score of 4.4 (Medium) reflects a meaningfully constrained attack surface: PR:H requires high-privilege access, and AC:H signals that exploitation is not trivially reproducible - likely requiring specific configuration or timing conditions. The S:C scope change elevates concern somewhat, as successful exploitation reaches beyond the WordPress application into victims' browsers. The delegable wpgmp_manage_location capability is a critical nuance: while PR:H implies admin-level control, site operators who assign this capability to editors or contributors effectively lower the practical privilege bar. No EPSS score was provided in the source data, preventing probabilistic exploitation likelihood assessment. The CVE is not listed in CISA KEV, and no POC has been identified, indicating no confirmed opportunistic or mass exploitation at time of analysis. Real-world priority is low for sites that strictly limit the wpgmp_manage_location capability to trusted administrators; it rises for multi-author WordPress environments where this capability has been delegated.

An attacker with administrator access (or a lower-privileged user to whom the wpgmp_manage_location capability has been delegated) navigates to the WP Maps location management interface and submits a crafted payload - such as a script tag or event handler - into the 'location_messages' field. The unescaped payload is persisted to the database and subsequently rendered without sanitization by put-wpgmp.php whenever any site visitor loads a page containing the affected map shortcode, causing the script to execute in the victim's browser and potentially harvesting session tokens or performing authenticated actions on their behalf. No public exploit code has been identified, but the vulnerability is straightforward to reproduce by any attacker with access to the location management interface.