Geo Mashup <= 1.13.19 Missing Authorization to Unauthenticated Plugin Settings Disclosure (CVE-2026-7552)

Vulnerability Overview Vulnerability Name: Geo Mashup <= 1.13.19 - Missing Authorization to Unauthenticated Plugin Settings Disclosure via 'geo_mashup_content' Parameter CVE ID: CVE-2026-7552 CVSS Score: 5.3 (Medium) Release Date: May 27, 2026 Last Updated: May 28, 2026 Researchers: t8anr8y9jn Impact Scope Affected Versions: <= 1.13.19 Fixed Version: 1.13.20 Vulnerability Description: The Geo Mashup plugin versions 1.13.19 and earlier contain an authorization bypass vulnerability. The plugin fails to properly verify user permissions before executing actions, allowing unauthenticated attackers to expose sensitive plugin configuration data, including Google Maps API keys and GeoNames service credentials. Remediation Fixed Version: Upgrade to version 1.13.20 or higher Additional Information References: - plugins.trac.wordpress.org (multiple links) Share Options: Facebook, Twitter, LinkedIn, Email Vulnerability Details Software Type: Plugin Software Slug: geo-mashup (view on wordpress.org) Fixed: Yes Fix Details: Update to version 1.13.20 or higher Recent Vulnerabilities Geo Mashup <= 1.13.18 - Authenticated (Contributor+) Stored Cross-Site Scripting - CVE ID: CVE-2026-27427 - CVSS Score: 6.4 - Researchers: Muhammad Yudha - DJ - Date: May 26, 2026 Geo Mashup <= 1.13.19 - Authenticated (Subscriber+) SQL Injection via 'geo_mashup_null_fields' Parameter - CVE ID: CVE-2026-6457 - CVSS Score: 6.5 - Researchers: Leonid Semenenko (lsemenenko) - Date: May 1, 2026 Geo Mashup <= 1.13.18 - Authenticated Time-Based SQL Injection via 'sort' Parameter - CVE ID: CVE-2026-4060 - CVSS Score: 7.5 - Researchers: Naoya Takahashi (naitko) - Date: May 1, 2026 Geo Mashup <= 1.13.18 - Unauthenticated Time-Based SQL Injection via 'map_post_type' Parameter - CVE ID: CVE-2026-4061 - CVSS Score: 7.5 - Researchers: Naoya Takahashi (naitko) - Date: May 1, 2026 Geo Mashup <= 1.13.18 - Unauthenticated Time-Based SQL Injection via 'object_id' Parameter - CVE ID: CVE-2026-4062 - CVSS Score: 7.5 - Researchers: Naoya Takahashi (naitko) - Date: May 1, 2026 Freemius <= 2.10.1 - Reflected DOM-Based Cross-Site Scripting via url Parameter - CVE ID: CVE-2024-13362 - CVSS Score: 6.1 - Researchers: Asaf Mozes - Date: April 30, 2026 Geo Mashup <= 1.13.17 - Unauthenticated SQL Injection via 'sort' Parameter - CVE ID: CVE-2026-2416 - CVSS Score: 7.5 - Researchers: Nabil Irawan - Date: February 24, 2026 Geo Mashup <= 1.13.16 - Unauthenticated Local File Inclusion - CVE ID: CVE-2026-48293 - CVSS Score: 8.1 - Researchers: Dimas Maulana - Date: July 25, 2025 Geo Mashup <= 1.13.13 - Authenticated (Contributor) Stored Cross-Site Scripting via geo_mashup_visible_posts_list Shortcode - CVE ID: CVE-2024-8990 - CVSS Score: 6.4 - Researchers: Peter Thaleikis - Date: September 30, 2024 Geo Mashup <= 1.13.12 - Authenticated (Contributor+) Stored Cross-Site Scripting - CVE ID: CVE-2024-44008 - CVSS Score: 6.5 - Researchers: LVT-holv2k - Date: September 16, 2024 Additional Information Copyright: 2012-2026 Defiant Inc. MITRE Corporation: 1999-2026 Contact Information: wfi-support@wordfence.com Service Information Business Hours: 9am-8pm ET, 6am-5pm PT, 2pm-1am UTC/GMT (excluding weekends and holidays) Response Time: 24/7 support, 365 days a year, 1-hour response time Service Terms Terms of Service: Terms of Service Privacy Policy: Privacy Policy and Notice at Collection Data Protection: Do Not Sell or Share My Personal Information Social Media Facebook: [Icon] Twitter: [Icon] Instagram: [Icon] Products and Support Products: Wordfence Free, Wordfence Premium, Wordfence Care, Wordfence Response, Wordfence CLI, Wordfence Intelligence, Wordfence Central Support: Documentation, Learning Center, Free Support, Premium Support News: Blog, In The News, Vulnerability Advisories About: About Wordfence, Affiliate Program, Employment, Contact, Security, CVE Request Form Update Subscription Subscribe: Sign up for news and updates from our panel of experienced security professionals. Email: you@example.com Agree to Terms: By checking this box I agree to the terms of service and privacy policy. Copyright Information Copyright: © 2012-2026 Defiant Inc. All Rights Reserved Miscellaneous Wordfence Intelligence: Provides free personal and commercial API access, as well as free webhook integration, to stay ahead of the latest vulnerabilities in the database. Summary Vulnerability Overview: The Geo Mashup plugin contains an authorization bypass vulnerability, allowing unauthenticated attackers to expose sensitive plugin configuration data. Impact Scope: Affected versions are <= 1.13.19; fixed version is 1.13.20. Remediation: Upgrade to version 1.13.20 or higher.

Goal Reached Thanks to every supporter — we hit 100%!

Geo Mashup <= 1.13.19 Missing Authorization to Unauthenticated Plugin Settings Disclosure (CVE-2026-7552)

More from this source