WordPress Plugin Vulnerabilities

MapSVG Lite < 8.6.5 - Missing Authorization

Description

The plugin is vulnerable to unauthorized access due to a missing capability check on a function. This makes it possible for authenticated attackers, with Contributor-level access and above, to perform an unauthorized action.

Affects Plugins

Plugin icon
mapsvg-lite-interactive-vector-maps
Fixed in 8.6.5

References

CVE
CVE-2025-32684
URL
https://patchstack.com/database/wordpress/plugin/mapsvg-lite-interactive-vector-maps/vulnerability/wordpress-mapsvg-lite-plugin-8-5-32-broken-access-control-vulnerability

Classification

Type
NO AUTHORISATION
OWASP top 10
A5: Broken Access Control
CWE
CWE-862
CVSS
4.3 (medium)

Miscellaneous

Original Researcher
Nguyễn Trung Kiên
Verified
No
WPVDB ID
d46082ea-8938-423f-9329-41826c7c6c78

Timeline

Publicly Published
2025-04-09 (about 1 year ago)
Added
2025-04-16 (about 1 year ago)
Last Updated
2025-05-29 (about 1 year ago)

Other

Published
Title
Published
2025-08-07
Title
SMM API <= 6.0.31 - Missing Authorization
Published
2025-11-28
Title
Gutenverse Form < 2.3.0 - Missing Authorization
Published
2025-01-06
Title
WP Visitor Statistics (Real Time Traffic) < 7.6 - Missing Authorization
Published
2024-04-29
Title
Booster Extension <= 1.2.0 - Basic Information Exposure via booster_extension_authorbox_shortcode_display
Published
2025-04-17
Title
Spice Blocks <= 2.0.7.6 - Missing Authorization