CVE-2023-5506 MEDIUM

CVE-2023-5506: ImageMapper <= 1.2.6 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Page/Post Deletion via imgmap_delete_area_ajax

Vendor Spikefinned
Product ImageMapper
Weakness CWE-862 · Missing authorization
Published November 7, 2023
Last update April 8, 2026
View on NVD All CVEs

CVSS base score

5.4/10
Attack vector Network
Attack complexity Low
Privileges required Low
User interaction None
Confidentiality None
Integrity Low

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L

What the vulnerability does

01Description

The ImageMapper plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability check on the 'imgmap_delete_area_ajax' function in versions up to, and including, 1.2.6. This makes it possible for authenticated attackers, with subscriber-level permissions and above, to delete arbitrary posts and pages.

Key dates

02Disclosure timeline

November 7, 2023 CVE published
April 8, 2026 Record updated

Related vulnerabilities

04Related CVE

CVE-2024-42470 CometVisu Backend for openHAB has a sensitive information disclosure vulnerability CVE-2025-60122 WordPress HivePress Claim Listings plugin <= 1.1.4 - Broken Access Control vulnerability CVE-2026-39700 WordPress WowOptin plugin <= 1.4.32 - Broken Access Control vulnerability CVE-2021-25087 Wordpress Download Manager < 3.2.25 - Sensitive Information Disclosure CVE-2022-2379 Easy Student Results <= 2.2.8 - Sensitive Information Disclosure via REST API