CVE-2026-7552
Authorization Bypass in Geo Mashup WordPress Plugin
Publication date: 2026-05-28
Last updated on: 2026-05-28
Assigner: Wordfence
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| geo_mashup | geo_mashup | to 1.13.19 (inc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-862 | The product does not perform an authorization check when an actor attempts to access a resource or perform an action. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
The Geo Mashup plugin for WordPress has an authorization bypass vulnerability in all versions up to and including 1.13.19. This means the plugin does not properly check if a user is authorized to perform certain actions.
As a result, unauthenticated attackers can exploit this flaw to access sensitive plugin configuration data without needing to log in.
- Exposed data includes Google Maps API keys and GeoNames service credentials.
How can this vulnerability impact me? :
This vulnerability allows unauthenticated attackers to access sensitive configuration information of the Geo Mashup plugin.
Exposure of Google Maps API keys and GeoNames service credentials can lead to unauthorized use of these services, potential service disruptions, or additional attacks leveraging these credentials.
The CVSS base score of 5.3 indicates a medium severity impact, primarily affecting confidentiality.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
The vulnerability in the Geo Mashup plugin allows unauthorized attackers to access sensitive plugin configuration data, including Google Maps API keys and GeoNames service credentials. Exposure of such sensitive information could potentially lead to non-compliance with data protection standards and regulations that require safeguarding sensitive data, such as GDPR and HIPAA.
However, the provided information does not explicitly detail the impact on compliance with specific standards like GDPR or HIPAA.