CVE-2026-73376

CriticalCVSS 9.8

Published: 18/08/2026(UTC)Translated: 18/08/2026(UTC)NVD NIST

Summary

Unauthenticated PHP Object Injection vulnerability in Ultimate Maps by Supsystic plugin versions before 1.5.0. An attacker without authentication can inject PHP objects, potentially leading to remote code execution.

Risk Assessment

Potential for remote code execution on the server, which may result in full system compromise.

Recommendation

Update the Ultimate Maps by Supsystic plugin to version 1.5.0 or later.

Original NVD description (English source)

Unauthenticated PHP Object Injection in Ultimate Maps by Supsystic < 1.5.0 versions.