# CVE-2026-115954: Geo Mashup broken access control in pages

Source: https://junglewise.ai/threats/cve-2026-115954-missing-authorization-vulnerability-in-dylan-kuhn-geo-mashup-geo  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-26. Updated: 2026-10-26  
License: CC BY 4.0 with a link back

CVE-2026-115954 · Severity: medium · CVSS 5.4 · Published 2026-10-26

Geo Mashup is a WordPress plugin that displays maps and location data. A broken access control vulnerability allows users with Contributor role to view or access pages and perform actions they should not be permitted to, potentially exposing sensitive information or enabling unauthorized actions on affected WordPress sites.

Technologies: [Dylan Kuhn Geo Mashup](https://junglewise.ai/threats/technologies/geo-mashup). Vendors: [Dylan Kuhn](https://junglewise.ai/threats/vendors/dylan-kuhn).

## Quick answers

**Is CVE-2026-115954 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-115954 being exploited in the wild.

**How severe is CVE-2026-115954?** Medium severity, with a CVSS score of 5.4, published 26 October 2026.

**Which products and versions are affected?** Dylan Kuhn Geo Mashup through 1.13.22.

**Is there a fix for CVE-2026-115954?** Yes: fixed in 1.13.23. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-115954 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-115954?** Check whether you run Dylan Kuhn Geo Mashup at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in 1.13.23

## Technical details

Geo Mashup versions up to 1.13.22 contain a broken access control vulnerability that allows users with insufficient privileges to access restricted functionality. The vulnerability requires Contributor-level privileges to exploit and affects access control enforcement on certain pages or operations within the plugin, allowing privilege escalation within the WordPress environment.

## Affected products

- Dylan Kuhn Geo Mashup through 1.13.22

## Timeline

- 2026-10-26: disclosed
- 2026-10-26: advisory

## References

- [https://wordpress.org/plugins](https://wordpress.org/plugins)
- [https://patchstack.com/database/wordpress/plugin/geo-mashup/vulnerability/wordpress-geo-mashup-plugin-1-13-22-broken-access-control-vulnerability?_s_id=cve](https://patchstack.com/database/wordpress/plugin/geo-mashup/vulnerability/wordpress-geo-mashup-plugin-1-13-22-broken-access-control-vulnerability?_s_id=cve)

## Related threats

- [Geo Mashup stored cross-site scripting](https://junglewise.ai/threats/cve-2026-115953-improper-neutralization-of-input-during-web-page-generation)
- [Geo Mashup reflected cross-site scripting](https://junglewise.ai/threats/cve-2026-111848-improper-neutralization-of-input-during-web-page-generation)
- [Geo Mashup cross-site scripting](https://junglewise.ai/threats/cve-2026-97250-unauthenticated-cross-site-scripting-xss-in-geo-mashup-1-13-21)
- [Dylan Kuhn Geo Mashup SQL injection in WordPress plugin](https://junglewise.ai/threats/cve-2026-48967-dylan-kuhn-geo-mashup-sql-injection-in-wordpress-plugin)
- [Dylan Kuhn Geo Mashup Reflected XSS](https://junglewise.ai/threats/cve-2026-42734-dylan-kuhn-geo-mashup-reflected-xss)