The vulnerability is a missing authorization flaw that allows attackers to bypass configured access control levels. By exploiting this flaw, an attacker could gain read or modify privileges to map data and potentially view sensitive geographic information that should be restricted to authorized users. The weakness is identified as CWE‑862, an incorrect or missing authorization check.

Supsystic Ultimate Maps by Supsystic plugin for WordPress, versions up to and including 1.5.3, is affected. The issue applies to all installations that have not applied the latest plugin update.

Based on the description, the likely attack vector is over the network via the WordPress site, where an attacker interacts with the mapping interface or API endpoints that lack proper authorization checks. The CVSS score of 5.3 indicates a moderate risk. No EPSS score is available, so the likelihood of exploitation is currently unknown. The vulnerability is not listed in the CISA KEV catalog, suggesting no known large‑scale exploitation.