CVE-2026-7552 is an authorization bypass vulnerability (CWE-862) in the Geo Mashup plugin for WordPress developed by cyberhobo. The flaw exists in all versions up to and including 1.13.19 due to improper verification of user authorization. This allows unauthenticated attackers to retrieve sensitive configuration data such as Google Maps API keys and GeoNames service credentials. The vulnerability has a CVSS 3.1 base score of 5.3, indicating medium severity. No patch or official remediation level has been published, and the product is not a cloud service.

An attacker without authentication can expose sensitive plugin configuration information, including API keys and service credentials. This could potentially lead to unauthorized use of these services or further attacks leveraging the exposed credentials. There is no indication of impact to data integrity or availability. No known exploits have been observed in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, consider restricting access to the plugin's configuration interfaces or disabling the plugin if sensitive data exposure risk is unacceptable. Monitor vendor channels for updates and apply patches promptly once available.