CVE-2026-19798 tusharimran CVE debrief

Who should care

Site administrators and security teams responsible for WordPress installations with the Wp Map Block plugin should review and update the plugin to version 3.0.1 or later. They should also restrict access to the Maps_Controller REST controller and monitor for suspicious activity on the WordPress site. Additionally, they should confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.

Why it matters

The Wp Map Block plugin for WordPress is vulnerable to unauthorized modification of data, allowing authenticated attackers with Contributor-level access and above to publish or unpublish (and bulk-delete) any wpmb_map post, including maps owned by administrators.

• Authenticated attackers with Contributor-level access and above can publish or unpublish (and bulk-delete) any wpmb_map post, including maps owned by administrators.
• This vulnerability allows for unauthorized modification of data, potentially hiding published maps from all public pages site-wide or forcing draft maps to become publicly visible.

Technical summary

The Wp Map Block plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the set_status() and bulk() functions in the Maps_Controller REST controller in versions up to, and including, 3.0.0. The plugin's permission_callback (can_edit()) only verifies current_user_can('edit_posts') and performs no object-level ownership check or verification of publish-level capabilities. This allows authenticated attackers with Contributor-level access and above to publish or unpublish (and bulk-delete) any wpmb_map post, including maps owned by administrators.

Defensive priority

Authenticated attackers with Contributor-level access and above can publish or unpublish (and bulk-delete) any wpmb_map post, including maps owned by administrators.

Recommended defensive actions

• Review and update the Wp Map Block plugin to version 3.0.1 or later.
• Restrict access to the Maps_Controller REST controller.
• Monitor for suspicious activity on the WordPress site.
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.
• Review compensating controls for exposed systems while remediation is scheduled and verified.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.

Evidence notes

The plugin's permission_callback (can_edit()) only verifies current_user_can('edit_posts') and performs no object-level ownership check or verification of publish-level capabilities. The handlers pass the caller-controlled map ID directly to wp_update_post() (and wp_delete_post() in the bulk delete branch) to change post_status between publish and draft. This oversight allows for unauthorized modification of data. The CVE record was published on 2026-10-16T07:17:13.217Z and has not been modified since then. The vulnerability has a CV

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.