The plugin lacks a proper capability check on the set_status() and bulk() functions in the Maps_Controller REST controller. The permission callback verifies only that the user can edit posts, without checking ownership or publish rights. As a result, any authenticated user with Contributor level or higher can send REST requests to change the post_status of any wpmb_map post, including those belonging to administrators, or delete them. The flaw is a classic missing authorization weakness, classified as CWE‑862.

WordPress sites running the WP Map Block plugin version 3.0.0 or earlier, maintained by the vendor tusharimran, are impacted. Users with Contributor or higher roles on those installations can exploit the missing authorization check.

The CVSS score of 4.3 indicates moderate severity, and the vulnerability is not listed in the CISA KEV catalog. EPSS shows a value of < 1%, indicating a very low but non‑zero likelihood of exploitation. The likely attack vector is an authenticated REST API request from a user with Contributor level or higher; privilege escalation is not required. Because the flaw operates through standard WordPress REST endpoints, an attacker can reach the vulnerable functions readily once authenticated, making the issue a moderate but actionable risk.