CVE-2026-123475: WordPress MapSVG plugin <= 8.16.3 - Broken Access Control vulnerability

Q: Which installations are affected?

MapSVG versions through 8.16.3 are affected. The affected version range begins at an unspecified earlier version.

Q: Does exploitation require an authenticated WordPress account or user interaction?

The CVSS vector indicates that no privileges and no user interaction are required. It also indicates the attack can be performed over the network.

Q: What is the reported security impact?

The reported impact is high confidentiality impact, with no integrity or availability impact indicated in the CVSS vector.

Published Nov 9, 2026

Updated

Missing Authorization vulnerability in PT Norther Lights Production MapSVG mapsvg-lite-interactive-vector-maps allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects MapSVG: from n/a through 8.16.3.

Affected Software

1 affected component

PT Northern Lights Production MapSVG<=8.16.3

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade WordPress MapSVG plugin to a version that resolves this vulnerability.
Fixed in 9.0.0

Event History

Nov 9, 2026

CVE Published

via MITRE·11:00 AM

Data Sourced

via MITRE·11:00 AM

RemedyDescriptionSeverityWeakness

Data Sourced

via NVD·11:17 AM

DescriptionSeverityWeakness

Frequently Asked Questions

Which installations are affected?

MapSVG versions through 8.16.3 are affected. The affected version range begins at an unspecified earlier version.

Does exploitation require an authenticated WordPress account or user interaction?

The CVSS vector indicates that no privileges and no user interaction are required. It also indicates the attack can be performed over the network.

What is the reported security impact?

The reported impact is high confidentiality impact, with no integrity or availability impact indicated in the CVSS vector.

CVE-2026-123475: WordPress MapSVG plugin <= 8.16.3 - Broken Access Control vulnerability

Affected Software

Remediation

Event History

Frequently Asked Questions

Which installations are affected?

Does exploitation require an authenticated WordPress account or user interaction?

What is the reported security impact?

Company

Resources

Contact

Frequently Asked Questions

Which installations are affected?

Does exploitation require an authenticated WordPress account or user interaction?

What is the reported security impact?