What is the CVSS score of EUVD-2026-48150?

EUVD-2026-48150 has a CVSS 3.1 base score of 5.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N. EPSS exploitation probability: 0.2%.

WP Go Maps EUVD-2026-48150

Q: Which versions of WP Go Maps are affected by EUVD-2026-48150?

Broken access control in WP Go Maps WordPress plugin versions 10.1.04 and earlier allows unauthenticated remote attackers to access restricted resources without authorization.

| CVE-2026-25466 MEDIUM

Missing Authorization (CWE-862)

2026-07-23 Patchstack

GHSA-2vr6-hcxv-cf3w

Authentication Bypass Wp Go Maps

5.3

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

5.3 MEDIUM

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

vuln.today AI

5.3 MEDIUM

Network-accessible WordPress endpoint with no authentication gate; impact is read-only partial confidentiality loss with no integrity or availability consequence.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 23, 2026 - 13:01 vuln.today

DescriptionCVE.org

Unauthenticated Broken Access Control in WP Go Maps <= 10.1.04 versions.

AnalysisAI

Broken access control in WP Go Maps WordPress plugin versions 10.1.04 and earlier allows unauthenticated remote attackers to access restricted resources without authorization. The flaw stems from missing authorization checks (CWE-862) on one or more plugin endpoints, enabling network-accessible exploitation with no credentials required. Impact is limited to a partial confidentiality breach - no data modification or availability impact - but the zero-barrier entry point makes it trivially reachable by automated scanners. No public exploit code or CISA KEV listing has been identified at time of analysis.

Technical ContextAI

WP Go Maps (formerly WP Google Maps) is a WordPress plugin published by wpgmaps, identified by CPE cpe:2.3:a:wpgmaps:wp_go_maps:*:*:*:*:*:*:*:*. The root cause is CWE-862 (Missing Authorization): one or more plugin REST API endpoints or AJAX handlers fail to verify that the requesting user possesses the required capability before returning data or performing an action. In WordPress, proper authorization typically requires calls to current_user_can() or equivalent capability checks; their absence allows any unauthenticated HTTP client to reach functionality that should be gated behind authentication or a specific role. The CVSS vector AV:N/AC:L/PR:N/UI:N confirms the endpoint is reachable over the network with no prerequisites.

RemediationAI

Update WP Go Maps to the version immediately above 10.1.04 - the exact patched version number is not confirmed in the available input data; consult the Patchstack advisory at https://patchstack.com/database/wordpress/plugin/wp-google-maps/vulnerability/wordpress-wp-go-maps-plugin-10-1-04-broken-access-control-vulnerability and the WordPress plugin repository changelog for the confirmed fix release. If an immediate upgrade is not possible, consider using a Web Application Firewall rule to block unauthenticated requests to the plugin's REST API namespace (typically /wp-json/wpgmaps/ or its registered AJAX actions) as a temporary compensating control; note this may break legitimate map-loading functionality for anonymous site visitors. Restricting REST API access to authenticated users globally (via WordPress settings or a security plugin) is a broader workaround but carries the trade-off of breaking other plugins that depend on public REST endpoints.