{"metadata": {"vulnerability": "CVE-2026-19798", "count": 14, "kinds": {"milestone": 4, "sighting": 1, "kev": 0, "other": 9}}, "data": [{"timestamp": "2026-08-13T19:47:58.655Z", "date_only": false, "value": "2026-08-13T19:47:58.655Z", "kind": "milestone", "label": "Reserved", "source": "cvelistv5", "record": "CVE-2026-19798", "field": "cveMetadata.dateReserved"}, {"timestamp": "2026-10-15T17:37:39Z", "date_only": false, "value": "2026-10-15T17:37:39.000Z", "kind": "other", "label": "Time", "source": "cvelistv5 / Wordfence", "record": "CVE-2026-19798", "field": "containers.cna.timeline.0.time"}, {"timestamp": "2026-10-16T06:41:05.739Z", "date_only": false, "value": "2026-10-16T06:41:05.739Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2026-19798", "field": "cveMetadata.datePublished"}, {"timestamp": "2026-10-16T06:41:05.739Z", "date_only": false, "value": "2026-10-16T06:41:05.739Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / Wordfence", "record": "CVE-2026-19798", "field": "containers.cna.providerMetadata.dateUpdated"}, {"timestamp": "2026-10-16T07:17:13Z", "date_only": false, "value": "2026-10-16T07:17:13Z", "kind": "other", "label": "Nvd published at", "source": "github \u00b7 GHSA-5899-9734-MQJW", "record": "GHSA-5899-9734-MQJW", "field": "database_specific.nvd_published_at"}, {"timestamp": "2026-10-16T07:17:13.217Z", "date_only": false, "value": "2026-10-16T07:17:13.217", "kind": "milestone", "label": "Published", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-19798", "record": "FKIE_CVE-2026-19798", "field": "published"}, {"timestamp": "2026-10-16T07:31:57.592Z", "date_only": false, "value": "2026-10-16T07:31:57.592429Z", "kind": "sighting", "label": "Seen", "source": "https://infosec.exchange/users/cve/statuses/117449419461429667", "record": "CVE-2026-19798", "field": "creation_timestamp", "uuid": "665c81ac-3249-44d9-9e3a-eb42bb21215c", "content": "CVE-2026-19798 WP Map Block <= 3.0.0 - Missing Authorization to Authenticated (Contributor+) Arbitrary Map Publish/Unpublish/Delete via set_status() and bulk() REST Endpoints The Wp Map Block plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the set_status() and bulk() functions in the Maps_Controller REST controller in versions up to, and including, 3.0.0. The plugin's permission_callback (can_edit()) only verifies current_user_can('edit_posts') and performs no object-level ownership check or verification of publish-level capabilities, while the handlers pass the caller-controlled map ID directly to wp_update_post() (and wp_delete_post() in the bulk delete branch) to change post_status between publish and draft. This makes it possible for authenticated attackers, with Contributor-level access and above, to publish or unpublish (and bulk-delete) any wpmb_map post, including maps owned by administrators, which hides published maps from all public pages site-wide or forces draft maps to become publicly visible.\nhttps://www.cve.org/CVERecord?id=CVE-2026-19798https://www.wordfence.com/threat-intel/vulnerabilities/id/b42f1f71-e272-48d4-9b3f-4360b287e16f?source=cvehttps://plugins.trac.wordpress.org/browser/wp-map-block/tags/3.0.0/includes/Rest/Maps_Controller.php#L237https://plugins.trac.wordpress.org/browser/wp-map-block/tags/3.0.0/includes/Rest/Maps_Controller.php#L262https://plugins.trac.wordpress.org/browser/wp-map-block/tags/3.0.0/includes/Rest/Maps_Controller.php#L124https://plugins.trac.wordpress.org/browser/wp-map-block/tags/3.0.0/includes/Rest/Maps_Controller.php#L63https://plugins.trac.wordpress.org/changeset?reponame=&old=3730836%40wp-map-block&new=3730836%40wp-map-block#wordpress #tusharimran #WPMapBlock\u2013GoogleMaps,OpenStreetMap,Mapbox,Store&ShopLocator,Directory,Listings&Filters#CVE_2026_19798#bot", "url": "https://infosec.exchange/users/cve/statuses/117449419461429667"}, {"timestamp": "2026-10-16T09:30:28Z", "date_only": false, "value": "2026-10-16T09:30:28Z", "kind": "milestone", "label": "Published", "source": "github \u00b7 GHSA-5899-9734-MQJW", "record": "GHSA-5899-9734-MQJW", "field": "published"}, {"timestamp": "2026-10-16T09:30:28Z", "date_only": false, "value": "2026-10-16T09:30:28Z", "kind": "other", "label": "Updated", "source": "github \u00b7 GHSA-5899-9734-MQJW", "record": "GHSA-5899-9734-MQJW", "field": "modified"}, {"timestamp": "2026-10-16T14:22:31.555Z", "date_only": false, "value": "2026-10-16T14:22:31.555056Z", "kind": "other", "label": "Recorded", "source": "cvelistv5 / CISA-ADP", "record": "CVE-2026-19798", "field": "containers.adp.0.metrics.0.other.content.timestamp"}, {"timestamp": "2026-10-16T14:22:31.555Z", "date_only": false, "value": "2026-10-16T14:22:31.555056Z", "kind": "other", "label": "Recorded", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-19798", "record": "FKIE_CVE-2026-19798", "field": "metrics.ssvcV203.0.ssvcData.timestamp"}, {"timestamp": "2026-10-16T14:22:54.237Z", "date_only": false, "value": "2026-10-16T14:22:54.237Z", "kind": "other", "label": "Updated", "source": "cvelistv5", "record": "CVE-2026-19798", "field": "cveMetadata.dateUpdated"}, {"timestamp": "2026-10-16T14:22:54.237Z", "date_only": false, "value": "2026-10-16T14:22:54.237Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / CISA-ADP", "record": "CVE-2026-19798", "field": "containers.adp.0.providerMetadata.dateUpdated"}, {"timestamp": "2026-10-16T15:17:15.747Z", "date_only": false, "value": "2026-10-16T15:17:15.747", "kind": "other", "label": "Updated", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-19798", "record": "FKIE_CVE-2026-19798", "field": "lastModified"}]}