CVE-2026-102397: WordPress Ultimate Maps by Supsystic plugin <= 1.5.5 - Broken Access Control vulnerability
Unauthenticated Broken Access Control in Ultimate Maps by Supsystic <= 1.5.5 versions.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
WordPress Ultimate Maps by Supsystic pluginto a version that resolves this vulnerability.Fixed in 1.6.1
Event History
Frequently Asked Questions
Who can exploit this issue?
The vulnerability is unauthenticated, so an attacker does not need a WordPress account or other prior privileges to attempt exploitation over the network.
Which installations are affected?
Ultimate Maps by Supsystic versions 1.5.5 and earlier are identified as affected. The supplied data does not state whether any particular WordPress configuration or plugin feature must be enabled.
What security impact is reported?
The reported CVSS vector indicates low confidentiality and low integrity impact, with no availability impact. Exploitation is rated low complexity and requires no user interaction.