CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
What the vulnerability does
The Geo Mashup plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 1.13.19. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated attackers to expose sensitive plugin configuration data, including Google Maps API keys and GeoNames service credentials, to unauthenticated attackers.
Explanation of Vulnerability in Simple Terms
Geo Mashup versions 1.13.19 and earlier lack proper authorization checks, allowing unauthenticated attackers to read sensitive location data. The vulnerability requires no user interaction and is exploitable over the network. Site administrators should update to a version newer than 1.13.19 to prevent unauthorized data disclosure.
What an attacker can do
Read sensitive location data without authentication.
Potential impact on your site
Visitor location information and map data may be exposed to unauthorized parties.
Conditions required to exploit
Network access only; no authentication or user interaction required.
Key dates
External resources
