The vulnerability is a missing authorization flaw that allows an attacker to bypass correctly configured access control security levels. By exploiting this weakness, an attacker could perform unauthorized actions within the WordPress site, such as editing, deleting, or creating maps and map content. These actions potentially lead to defacement, persistent presence of malicious content, or further exploitation of the site’s data and functionality.

Affected systems include the WordPress MapSVG plugin (MapSVG mapsvg-lite-interactive-vector-maps) from PT Norther Lights Production. All releases from the earliest available version up to and including 8.16.3 are impacted.

In terms of risk, the vulnerability carries a CVSS score of 7.5, indicating moderate to high severity. EPSS is not available, and the vulnerability is not listed in CISA’s KEV catalog. The likely attack vector is via a web-based interface that does not enforce proper authorization, suggesting that an attacker with access to the public site (or possibly an authenticated user with limited permissions) could exploit the flaw, potentially escalating privileges to perform unrestricted changes to map data.