{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-3581", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "state": "PUBLISHED", "assignerShortName": "Wordfence", "dateReserved": "2026-03-05T01:33:08.674Z", "datePublished": "2026-04-16T05:29:55.137Z", "dateUpdated": "2026-04-16T05:29:55.137Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-16T05:29:55.137Z"}, "affected": [{"vendor": "iandunn", "product": "Basic Google Maps Placemarks", "versions": [{"version": "0", "status": "affected", "lessThanOrEqual": "1.10.7", "versionType": "semver"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "The Basic Google Maps Placemarks plugin for WordPress is vulnerable to authorization bypass in versions up to, and including, 1.10.7. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated attackers to modify stored map latitude and longitude options."}], "title": "Basic Google Maps Placemarks <= 1.10.7 - Missing Authorization to Unauthenticated Default Map Coordinate Update", "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/b8a2bbfe-eb87-4e26-ba20-bc406d681124?source=cve"}, {"url": "https://plugins.trac.wordpress.org/changeset/3495944/basic-google-maps-placemarks"}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-862 Missing Authorization", "cweId": "CWE-862", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N", "baseScore": 5.3, "baseSeverity": "MEDIUM"}}], "credits": [{"lang": "en", "type": "finder", "value": "Chawabhon Netisingha"}], "timeline": [{"time": "2026-03-31T19:14:54.000Z", "lang": "en", "value": "Vendor Notified"}, {"time": "2026-04-15T16:47:25.000Z", "lang": "en", "value": "Disclosed"}]}}}

{}

{"cveTags": [], "descriptions": [{"lang": "en", "value": "The Basic Google Maps Placemarks plugin for WordPress is vulnerable to authorization bypass in versions up to, and including, 1.10.7. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated attackers to modify stored map latitude and longitude options."}], "id": "CVE-2026-3581", "lastModified": "2026-04-16T06:16:13.433", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 1.4, "source": "security@wordfence.com", "type": "Primary"}]}, "published": "2026-04-16T06:16:13.433", "references": [{"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/changeset/3495944/basic-google-maps-placemarks"}, {"source": "security@wordfence.com", "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/b8a2bbfe-eb87-4e26-ba20-bc406d681124?source=cve"}], "sourceIdentifier": "security@wordfence.com", "vulnStatus": "Received", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-862"}], "source": "security@wordfence.com", "type": "Primary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,1.10.7]"}}], "enrichment": {"confidence": 100.0, "confidence_source": "cna", "scores": [{"score": 100.0, "source": "cna"}]}, "original": {"product": "Basic Google Maps Placemarks", "source": "cna", "vendor": "iandunn"}, "product": "basic_google_maps_placemarks", "vendor": "iandunn"}, {"configurations": [{"platform": null, "status": "unaffected", "versions": null}], "enrichment": {"confidence": 80.0, "confidence_source": "inferred", "scores": [{"score": 80.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "product": "wordpress", "vendor": "wordpress"}], "analysis": {"en": {"generated_at": "2026-04-16T08:54:31.847079+00:00", "value": {"mitigation_remediation": ["Update the Basic Google Maps Placemarks plugin to a version newer than 1.10.7 once it becomes available.", "If an update cannot be applied immediately, temporarily disable or delete the plugin to prevent unauthorized configuration changes.", "Restrict administrative access to trusted users and consider implementing IP whitelisting or two\u2011factor authentication for the WordPress admin area to reduce the likelihood of exploitation."], "summary": {"action": "Update plugin", "impact": "Unauthorized modification of map coordinates"}, "threat_synthesis": {"affected_systems": "Affected systems include deployments of the iandunn Basic Google Maps Placemarks WordPress plugin, specifically all versions up to and including 1.10.7. Users running these versions are at risk of having their map coordinate configuration tampered with by unauthenticated actors if the plugin remains active.", "description_and_impact": "The Basic Google Maps Placemarks plugin for WordPress contains an authorization bypass flaw that allows unauthenticated users to alter stored latitude and longitude settings. This is caused by improper verification that a user has permission to perform the update action, and matches the improper authorization weakness identified as CWE-862. The flaw does not provide remote code execution or arbitrary file access, but it permits changes to configuration that could redirect map displays or mislead users.", "risk_and_exploitability": "The CVSS score for this vulnerability is 5.3, indicating a medium severity. No EPSS value is available and the vulnerability is not listed in the CISA KEV catalog. The attack requires network access to the WordPress site and the ability to authenticate to the plugin\u2019s admin interface, which can be achieved by sending a crafted HTTP request to update the map settings. Because authentication is bypassed, an attacker does not need any credentials, so the risk is limited by the reach of the malicious request and the exposure of the site\u2019s admin area."}}}}, "created": "2026-04-16T09:00:05.290638+00:00", "updated": "2026-04-16T09:11:42.981990+00:00", "vendors": ["iandunn", "iandunn$PRODUCT$basic_google_maps_placemarks", "wordpress", "wordpress$PRODUCT$wordpress"]}