CVE-2026-3581: WordPress Maps Placemarks Auth Bypass Flaw

CVE-2026-3581 Overview

The Basic Google Maps Placemarks plugin for WordPress contains an authorization bypass vulnerability in versions up to and including 1.10.7. This security flaw stems from the plugin failing to properly verify that a user is authorized to perform certain actions. As a result, unauthenticated attackers can exploit this vulnerability to modify stored map latitude and longitude options without any authentication.

Critical Impact

Unauthenticated attackers can manipulate map coordinates, potentially redirecting users to incorrect locations or facilitating phishing/social engineering attacks through modified map data.

Affected Products

• Basic Google Maps Placemarks plugin for WordPress versions up to and including 1.10.7

Discovery Timeline

• April 16, 2026 - CVE-2026-3581 published to NVD
• April 16, 2026 - Last updated in NVD database

Technical Details for CVE-2026-3581

Vulnerability Analysis

This vulnerability is classified as CWE-862 (Missing Authorization), which occurs when a software component does not perform an authorization check when an actor attempts to access a resource or perform an action. In the context of this WordPress plugin, the authorization bypass allows unauthenticated users to access functionality that should be restricted to authenticated administrators.

The vulnerability is network-accessible, meaning attackers can exploit it remotely without requiring any prior authentication or user interaction. The primary impact is to data integrity, as attackers can modify the stored map coordinates (latitude and longitude values) that the plugin uses to display Google Maps markers.

Root Cause

The root cause of this vulnerability is the absence of proper capability checks or nonce verification in the plugin's AJAX handlers or form processing functions. WordPress plugins that handle user input and modify options should implement current_user_can() checks and validate nonces to ensure only authorized users can perform privileged actions. The Basic Google Maps Placemarks plugin failed to implement these security controls, leaving the map configuration endpoints exposed to unauthenticated requests.

Attack Vector

An attacker can exploit this vulnerability by sending crafted HTTP requests directly to the WordPress AJAX endpoint or the plugin's form handlers. Since no authentication or authorization checks are performed, the attacker can submit arbitrary latitude and longitude values that will be stored in the WordPress database and subsequently displayed on the site's maps.

The attack can be conducted entirely remotely with no prerequisites—the attacker does not need valid credentials, user interaction, or any special privileges. This makes the vulnerability particularly easy to exploit at scale against WordPress sites running vulnerable versions of the plugin.

Detection Methods for CVE-2026-3581

Indicators of Compromise

• Unexpected changes to map coordinates in the WordPress options table (specifically latitude/longitude values for Google Maps placemarks)
• HTTP POST requests to WordPress AJAX endpoints from unauthenticated sources attempting to modify map settings
• Suspicious activity in web server access logs showing requests to plugin-specific endpoints without corresponding authenticated sessions

Detection Strategies

• Monitor WordPress options table for unauthorized modifications to plugin settings, particularly map coordinate values
• Implement web application firewall (WAF) rules to detect and block unauthenticated requests attempting to modify plugin options
• Review access logs for anomalous patterns of requests targeting the Basic Google Maps Placemarks plugin endpoints
• Deploy WordPress security plugins that can detect unauthorized option changes and alert administrators

Monitoring Recommendations

• Enable WordPress audit logging to track all option modifications with timestamps and source IP addresses
• Configure alerting for any changes to map-related settings that occur outside of authenticated admin sessions
• Regularly review the integrity of stored map coordinates against known-good values

How to Mitigate CVE-2026-3581

Immediate Actions Required

• Update the Basic Google Maps Placemarks plugin to a patched version immediately
• Review the WordPress options table for any unauthorized modifications to map coordinates
• Verify that all stored latitude and longitude values match expected configurations
• Consider temporarily disabling the plugin if an update is not immediately available

Patch Information

A security patch addressing this vulnerability is available. The fix can be reviewed in the WordPress Plugin Changeset. Additional technical details are available in the Wordfence Vulnerability Report.

Site administrators should update the plugin through the WordPress admin dashboard or by manually downloading the latest version from the WordPress plugin repository.

Workarounds

• If immediate patching is not possible, temporarily deactivate the Basic Google Maps Placemarks plugin until the update can be applied
• Implement WAF rules to block unauthenticated POST requests to the plugin's AJAX handlers
• Restrict access to WordPress admin AJAX endpoints at the web server level using IP-based allow lists
• Consider using a WordPress security plugin that provides virtual patching capabilities for known vulnerabilities

# Example: Block unauthenticated access to plugin endpoints via .htaccess
# Add to WordPress .htaccess file (Apache)
<IfModule mod_rewrite.c>
RewriteEngine On
RewriteCond %{REQUEST_URI} ^.*wp-admin/admin-ajax\.php.*$
RewriteCond %{REQUEST_METHOD} POST
RewriteCond %{HTTP_COOKIE} !wordpress_logged_in
RewriteCond %{QUERY_STRING} action=.*bgmp.*
RewriteRule .* - [F,L]
</IfModule>