CVE-2026-7552

Vulnerability

The Geo Mashup plugin for WordPress versions up to and including 1.13.19 contains an authorization bypass vulnerability. The plugin does not properly verify that a user is authorized to perform certain actions, leading to exposure of sensitive plugin configuration data such as Google Maps API keys and GeoNames service credentials. The vulnerable code is present in the plugin's main file geo-mashup.php [1].

Exploitation

An unauthenticated attacker can exploit this vulnerability by sending a crafted request to the plugin's endpoints that lack proper capability checks. No authentication or special privileges are required. The attacker can directly access the configuration data without any user interaction.

Impact

Successful exploitation allows an unauthenticated attacker to retrieve sensitive configuration data, including Google Maps API keys and GeoNames credentials. This could lead to unauthorized use of these services, potential financial charges, or further attacks leveraging the exposed keys.

Mitigation

As of the publication date (2026-05-28), no fixed version has been released. Users should monitor the plugin's repository for updates. Until a patch is available, consider disabling the plugin or restricting access to its endpoints via web application firewall rules. The vulnerability is not listed in CISA's Known Exploited Vulnerabilities catalog at this time.