CVE-2026-115954: WordPress Geo Mashup plugin <= 1.13.22 - Broken Access Control vulnerability

Q: Who can exploit this issue?

The CVSS vector indicates that an attacker needs network access and low-level privileges. No user interaction is required.

Q: What security impact can exploitation have?

Successful exploitation may result in limited disclosure of information and limited modification of data. The vulnerability does not have an indicated availability impact.

Q: Which Geo Mashup versions are affected?

Geo Mashup versions through 1.13.22 are affected. The provided information does not identify a fixed version.

Published Oct 26, 2026

Updated

Missing Authorization vulnerability in Dylan Kuhn Geo Mashup geo-mashup allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Geo Mashup: from n/a through 1.13.22.

Affected Software

1 affected component

wordpress/geo-mashup<=1.13.22

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade WordPress Geo Mashup plugin to a version that resolves this vulnerability.
Fixed in 1.13.23

Event History

Oct 26, 2026

CVE Published

via MITRE·10:27 AM

Data Sourced

via MITRE·10:27 AM

RemedyDescriptionSeverityWeakness

Frequently Asked Questions

Who can exploit this issue?

The CVSS vector indicates that an attacker needs network access and low-level privileges. No user interaction is required.

What security impact can exploitation have?