Open User Map EUVD-2026-48506

Exploitation requires a WordPress account with at minimum contributor-level privileges on the target site - this is the lowest role that can create posts. No post publication is required; the attack fires when an Administrator views the pending-review preview of the contributor's draft, which is a routine editorial action. The plugin must be installed and active, and an admin must access the preview of the malicious post. Limiting factors: the attacker must have authenticated access (contributor or above), and payload delivery depends on an Administrator opening the pending-review page. Sites that disable contributor registration or require manual account approval reduce the attacker's ability to obtain the necessary foothold. The vulnerability does not affect installations where no contributors submit posts for admin review.

The CVSS 3.1 score of 6.4 Medium reflects network reachability (AV:N), low complexity (AC:L), low privilege (PR:L), and changed scope (S:C), with confidentiality and integrity impacts rated Low each. The changed-scope rating is appropriate because a contributor-level attacker can elevate impact to administrator-level browser sessions. The assigned UI:N is debatable - the admin must open the pending-review preview for the payload to fire, which technically constitutes user interaction (UI:R), and this analysis assesses it as such (see assessed_cvss_vector). The real-world risk is elevated by the pending-review attack path: an attacker does not need to wait for a post to go live, making the window between compromise and detection very short. EPSS data is not present in available intelligence; however, the wide WordPress install base and low barrier to contributor registration on many sites increase practical exposure. No CISA KEV listing or public POC exploit is confirmed, keeping urgency moderate, but the editorial workflow bypass is a meaningful aggravating factor.

An attacker registers or compromises a contributor-level WordPress account on a target site running Open User Map through 1.4.45. They create a new post embedding an Open User Map shortcode with a crafted attribute value containing a malicious JavaScript payload, then submit it for pending review without publishing. When a site Administrator opens the pending-review preview as part of normal editorial workflow, the injected script executes in the admin's browser, potentially harvesting session cookies, performing privileged actions via the WordPress admin API, or creating rogue admin accounts. No published POC is confirmed, but the vulnerable source lines are publicly accessible in the plugin Trac repository.