CVE-2026-0593 describes a missing authorization vulnerability in the WP Go Maps WordPress plugin. The processBackgroundAction() function lacks proper capability checks, enabling authenticated users with minimal privileges (Subscriber-level and above) to alter global map engine settings. This unauthorized modification could impact the integrity of the plugin's configuration. The vulnerability affects all versions up to 10.0.04. The CVSS score of 5.3 reflects a medium severity with network attack vector and low attack complexity. No patch or vendor advisory information is currently available.

An attacker with authenticated Subscriber-level access or higher can modify global map engine settings without authorization. This could lead to unauthorized changes in plugin behavior or configuration, potentially affecting website functionality or user experience. There is no indication of confidentiality or availability impact. No known exploits have been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict user roles to trusted individuals and monitor for unauthorized changes to map settings. Avoid granting Subscriber-level or higher access to untrusted users.