{
 "id": "WPSEC-2026-0542",
 "url": "https://wpsec.com/vuln/WPSEC-2026-0542/",
 "json_url": "https://wpsec.com/vuln/WPSEC-2026-0542/advisory.json",
 "markdown_url": "https://wpsec.com/vuln/WPSEC-2026-0542/index.md",
 "title": "WP Map Block <= 3.0.0 - Authenticated (Contributor+) Missing Authorization to Arbitrary Map Modification, Publication and Deletion",
 "description": "The WP Map Block plugin for WordPress is vulnerable to unauthorized modification and loss of data via its map REST API endpoints in version 3.0.0. This is due to the create, update, delete, duplicate, status and bulk callbacks relying only on the generic 'edit_posts' capability, without per-map capability checks. This makes it possible for authenticated attackers, with Contributor-level access and above, to edit, duplicate, publish, unpublish or permanently delete any map, including maps owned by administrators, and to create published maps without the publish capability.",
 "plugin": {
  "slug": "wp-map-block",
  "name": "WP Map Block",
  "full_name": "WP Map Block – Google Maps, OpenStreetMap, Mapbox, Store & Shop Locator, Directory, Listings & Filters",
  "wordpress_org": "https://wordpress.org/plugins/wp-map-block/",
  "advisories_url": "https://wpsec.com/vuln/plugin/wp-map-block/",
  "attacksurface": "https://attacksurface.wpsec.com/plugin/wp-map-block"
 },
 "type": "NO AUTHORISATION",
 "cwe": [
  "CWE-862"
 ],
 "cve": [],
 "cvss": {
  "version": "3.1",
  "score": 5.4,
  "vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L",
  "severity": "Medium"
 },
 "affected": {
  "ranges": [
   {
    "from": "3.0.0",
    "from_inclusive": true,
    "to": "3.1.0",
    "to_inclusive": false
   }
  ],
  "text": [
   "from 3.0.0 before 3.1.0"
  ]
 },
 "introduced_in": "3.0.0",
 "fixed_in": "3.1.0",
 "remediation": "Update to 3.1.0 or later.",
 "fix_released": "2026-10-06T13:07:35+00:00",
 "published": "2026-10-07T13:54:10+00:00",
 "updated": "2026-10-07T12:34:57.671163+00:00",
 "also_published_as": null,
 "references": [
  "https://wpsec.com/vuln/WPSEC-2026-0542/",
  "https://plugins.svn.wordpress.org/wp-map-block/tags/3.1.0/",
  "https://wordpress.org/plugins/wp-map-block/"
 ],
 "attacksurface_url": "https://attacksurface.wpsec.com/plugin/wp-map-block",
 "source": "WPSec",
 "license": {
  "name": "CC BY 4.0",
  "url": "https://creativecommons.org/licenses/by/4.0/"
 },
 "usage": {
  "plugin": "Low",
  "affected_versions": "Low",
  "as_of": "2026-10-07"
 }
}