CVE-2026-19798

The Wp Map Block plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the set status() and bulk() functions in the Maps Controller REST controller in versions up to, and including, 3.0.0. The plugin's permission callback (can edit()) only verifies current user can('edit posts') and performs no object-level ownership check or verification of publish-level capabilities, while the handlers pass the caller-controlled map ID directly to wp update post() (and wp delete post() in the bulk delete branch) to change post status between publish and draft. This makes it possible for authenticated attackers, with Contributor-level access and above, to publish or unpublish (and bulk-delete) any wpmb map post, including maps owned by administrators, which hides published maps from all public pages site-wide or forces draft maps to become publicly visible.