The Basic Google Maps Placemarks plugin for WordPress contains an authorization bypass flaw that allows unauthenticated users to alter stored latitude and longitude settings. This is caused by improper verification that a user has permission to perform the update action, and matches the improper authorization weakness identified as CWE-862. The flaw does not provide remote code execution or arbitrary file access, but it permits changes to configuration that could redirect map displays or mislead users.

Affected systems include deployments of the iandunn Basic Google Maps Placemarks WordPress plugin, specifically all versions up to and including 1.10.7. Users running these versions are at risk of having their map coordinate configuration tampered with by unauthenticated actors if the plugin remains active.

The CVSS score for this vulnerability is 5.3, indicating a medium severity. No EPSS value is available and the vulnerability is not listed in the CISA KEV catalog. The attack requires network access to the WordPress site and the ability to authenticate to the plugin’s admin interface, which can be achieved by sending a crafted HTTP request to update the map settings. Because authentication is bypassed, an attacker does not need any credentials, so the risk is limited by the reach of the malicious request and the exposure of the site’s admin area.