CVE-2026-19798: WP Map Block <= 3.0.0 - Missing Authorization to Authenticated (Contributor+) Arbitrary Map Publish/Unpublish/Delete via set_status() and bulk() REST Endpoints
The Wp Map Block plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the setstatus() and bulk() functions in the MapsController REST controller in versions up to, and including, 3.0.0. The plugin's permissioncallback (canedit()) only verifies currentusercan('editposts') and performs no object-level ownership check or verification of publish-level capabilities, while the handlers pass the caller-controlled map ID directly to wpupdatepost() (and wpdeletepost() in the bulk delete branch) to change poststatus between publish and draft. This makes it possible for authenticated attackers, with Contributor-level access and above, to publish or unpublish (and bulk-delete) any wpmbmap post, including maps owned by administrators, which hides published maps from all public pages site-wide or forces draft maps to become publicly visible.
Affected Software
Event History
Frequently Asked Questions
What level of access does an attacker need?
An attacker must be authenticated with Contributor-level access or higher. The affected permission check only requires the edit_posts capability.
Can a low-privileged user modify maps they do not own?
Yes. The affected REST handlers do not perform an object-level ownership check or verify publish-level capabilities, so a qualifying user can target wpmb_map posts owned by administrators or other users.
What impact can an attacker have on site content?
They can publish or unpublish maps, causing publicly visible maps to be hidden site-wide or draft maps to become publicly visible. The bulk operation can also delete maps.
Which plugin versions are affected?
Wp Map Block versions up to and including 3.0.0 are affected.