Unauthorized Data Modification in Wp Map Block Plugin for WordPress

CVE-2026-19798

What is CVE-2026-19798?

The Wp Map Block plugin for WordPress contains a flaw that allows unauthorized data modification due to insufficient capability checks on specific REST controller functions. The missing verification in the permission callback permits authenticated users with at least Contributor-level access to manipulate map posts. This vulnerability enables attackers to alter the publication status of wpmb_map posts, potentially impacting the visibility of maps across the site. As a result, malicious users can publish, unpublish, or bulk-delete maps owned by others, including administrators, leading to a unique risk where site content can be hidden or exposed without proper authorization.

References