CVE-2026-7552: Geo Mashup WordPress Auth Bypass Flaw

CVE-2026-7552 Overview

CVE-2026-7552 is an authorization bypass vulnerability in the Geo Mashup plugin for WordPress affecting all versions up to and including 1.13.19. The plugin fails to properly verify whether a user is authorized to perform certain actions. Unauthenticated attackers can exploit this flaw to expose sensitive plugin configuration data, including Google Maps API keys and GeoNames service credentials. The weakness maps to [CWE-862: Missing Authorization]. Exposed API credentials can be abused by third parties, leading to billing fraud, quota exhaustion, and downstream service disruption for the affected WordPress site owner.

Critical Impact

Unauthenticated remote attackers can retrieve Google Maps API keys and GeoNames service credentials from any WordPress site running Geo Mashup 1.13.19 or earlier.

Affected Products

• Geo Mashup plugin for WordPress, all versions through 1.13.19
• WordPress sites with the Geo Mashup plugin enabled
• Google Maps API keys and GeoNames credentials stored in plugin configuration

Discovery Timeline

• 2026-05-28 - CVE-2026-7552 published to NVD
• 2026-05-28 - Last updated in NVD database

Technical Details for CVE-2026-7552

Vulnerability Analysis

The vulnerability is an authorization bypass in the Geo Mashup WordPress plugin. Geo Mashup integrates mapping services into WordPress, requiring API credentials for Google Maps and GeoNames. These credentials are stored in plugin options and intended to be readable only by site administrators.

The plugin exposes endpoints or actions that return configuration data without first checking whether the requesting user holds appropriate capabilities. Because no authentication or capability check is performed, an unauthenticated attacker can issue a crafted HTTP request to the WordPress site and receive sensitive configuration values in the response. The affected logic resides in geo-mashup.php around lines 515, 528, and 1525 according to the WordPress plugin source tree.

Root Cause

The root cause is missing authorization enforcement [CWE-862]. The plugin code paths that read and return configuration values do not invoke a current_user_can() capability check or verify a valid nonce before disclosing data. The vendor remediated the issue in changeset 3503627, which adds the missing authorization checks.

Attack Vector

The attack is performed remotely over the network with no authentication and no user interaction. An attacker identifies a WordPress site running Geo Mashup and issues an HTTP request to the vulnerable plugin endpoint. The server responds with configuration values, including the Google Maps API key and GeoNames credentials. The attacker can then reuse the stolen API keys against the third-party services, consuming the victim's quota or generating fraudulent charges.

No verified public proof-of-concept code is currently available. Refer to the Wordfence vulnerability report for additional context.

Detection Methods for CVE-2026-7552

Indicators of Compromise

• Unauthenticated HTTP requests to Geo Mashup plugin endpoints returning JSON or serialized data containing keys such as google_key or geonames_username.
• Anomalous API usage or billing alerts from Google Cloud Console tied to a Maps API key associated with the WordPress site.
• Unexpected GeoNames API consumption from IP addresses not associated with the WordPress server.
• Web server access logs showing repeated requests to geo-mashup.php action handlers from external IPs.

Detection Strategies

• Audit installed WordPress plugins for Geo Mashup at version 1.13.19 or earlier and flag affected sites for prioritized patching.
• Inspect web server and WAF logs for HTTP requests targeting Geo Mashup action parameters and review response bodies for credential-shaped strings.
• Correlate WordPress access logs with Google Cloud and GeoNames API usage telemetry to identify credential reuse from unexpected origins.

Monitoring Recommendations

• Enable HTTP referer and rate-limit monitoring on Google Maps API keys, and restrict keys to the expected site domains.
• Alert on outbound API calls to Google Maps and GeoNames originating from IPs outside the WordPress hosting infrastructure.
• Monitor for new or modified WordPress plugin files and configuration options that suggest tampering or post-exploitation activity.

How to Mitigate CVE-2026-7552

Immediate Actions Required

• Update the Geo Mashup plugin to the patched release that follows version 1.13.19 as soon as the WordPress.org repository publishes the fix in changeset 3503627.
• Rotate the Google Maps API key and GeoNames credentials configured in Geo Mashup, treating the existing values as compromised.
• Apply HTTP referer, IP, and API restrictions to the new Google Maps API key in the Google Cloud Console to limit abuse if exposed again.
• If the plugin is not in active use, deactivate and remove it until a patched version is verified and installed.

Patch Information

The vendor addressed CVE-2026-7552 in changeset 3503627, which introduces authorization checks on the previously unprotected code paths in geo-mashup.php at lines 515, 528, and 1525. Site administrators should upgrade Geo Mashup to the first release that includes this changeset and confirm the installed version via the WordPress admin Plugins screen.

Workarounds

• Restrict access to the Geo Mashup plugin endpoints at the web server or WAF layer until the patched version is installed.
• Scope the Google Maps API key to specific HTTP referers and required APIs in the Google Cloud Console to limit damage from disclosure.
• Remove or replace API credentials in plugin settings with low-privilege values until rotation and patching are complete.