CVE-2026-7552
Received Received - Intake

Authorization Bypass in Geo Mashup WordPress Plugin

Publication date: 2026-05-28

Last updated on: 2026-05-28

Assigner: Wordfence

Description
The Geo Mashup plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 1.13.19. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated attackers to expose sensitive plugin configuration data, including Google Maps API keys and GeoNames service credentials, to unauthenticated attackers.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-05-28
Last Modified
2026-05-28
Generated
2026-07-08
AI Q&A
2026-05-28
EPSS Evaluated
2026-07-06
NVD
CVE-2026-7552
EUVD
EUVD-2026-32734

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
geo_mashup geo_mashup to 1.13.19 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-862 The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

The Geo Mashup plugin for WordPress has an authorization bypass vulnerability in all versions up to and including 1.13.19. This means the plugin does not properly check if a user is authorized to perform certain actions.

As a result, unauthenticated attackers can exploit this flaw to access sensitive plugin configuration data without needing to log in.

  • Exposed data includes Google Maps API keys and GeoNames service credentials.
Impact Analysis

This vulnerability allows unauthenticated attackers to access sensitive configuration information of the Geo Mashup plugin.

Exposure of Google Maps API keys and GeoNames service credentials can lead to unauthorized use of these services, potential service disruptions, or additional attacks leveraging these credentials.

The CVSS base score of 5.3 indicates a medium severity impact, primarily affecting confidentiality.

Compliance Impact

The vulnerability in the Geo Mashup plugin allows unauthorized attackers to access sensitive plugin configuration data, including Google Maps API keys and GeoNames service credentials. Exposure of such sensitive information could potentially lead to non-compliance with data protection standards and regulations that require safeguarding sensitive data, such as GDPR and HIPAA.

However, the provided information does not explicitly detail the impact on compliance with specific standards like GDPR or HIPAA.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-7552. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart