WordPress Geo Mashup plugin <= 1.13.22 - Broken Access Control vulnerability

geo-mashup · Missing authorization · CWE-862

Affectedgeo-mashup

FixUpdate to 1.13.23 or newer

PublishedOct 26, 10:27 · Patchstack

ScoredOct 26 · 5.4 · Patchstack

Exploit code publicNone known · checked 21:18 UTC

ExploitedNone known · CISA KEV checked 22:10 UTC

What we know

No known exploitation. CISA KEV, checked 22:10 UTC.

No public exploit code known. Exploit-DB, Metasploit, Nuclei, checked 21:18 UTC.

An attacker needs network access and an account. CVSS: network, low privileges.

Description

Missing Authorization vulnerability in Dylan Kuhn Geo Mashup geo-mashup allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Geo Mashup: from n/a through 1.13.22.

From Patchstack

Affected and fixed versions

ProductAffectedFixed ingeo-mashupearlier versions1.13.23

Exploit code

Exploit-DBnone knownMetasploitnone knownNucleinone known

References

patchstack.com/database/wordpress/plugin/geo-mashup/vulnerability/wordpress-geo-mashup-plugin-1-13-22-broken-access-control-vulnerability?_s_id=cve · patchstack.comvdb entry

Other CVEs in geo-mashup

All 11 →

6.5WordPress Geo Mashup plugin <= 1.13.22 - Cross Site Scripting (XSS) vulnerability · CVE-2026-115953Oct 26 7.1WordPress Geo Mashup plugin <= 1.13.22 - Cross Site Scripting (XSS) vulnerability · CVE-2026-111848Oct 21 7.1WordPress Geo Mashup plugin <= 1.13.21 - Cross Site Scripting (XSS) vulnerability · CVE-2026-97250Sep 30