CVE-2026-85309
MediumCVSS 5.3Exploitation Probability (EPSS)
Low risk7th percentile - higher than 7% of all known CVEs
Summary
Missing Authorization vulnerability in Supsystic Ultimate Maps by Supsystic allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Ultimate Maps by Supsystic: from n/a through 1.5.3.
Risk Assessment
An attacker can gain unauthorized access to plugin functionality, potentially leading to data breach or content manipulation.
Recommendation
Update the Ultimate Maps by Supsystic plugin to the latest version. Review and fix access control configuration.
Other vulnerabilities in Ultimate Maps by Supsystic
See all- CVE-2026-73376Critical
Unauthenticated PHP Object Injection vulnerability in Ultimate Maps by Supsystic plugin versions before 1.5.0. An attacker without authentication can inject PHP objects, potentially leading to remote code execution.
- CVE-2026-73377High
Unauthenticated Broken Access Control vulnerability in Ultimate Maps by Supsystic versions prior to 1.5.0.
- CVE-2026-73375High
Unauthenticated Cross Site Scripting (XSS) vulnerability in Ultimate Maps by Supsystic versions prior to 1.5.0.
Original NVD description (English source)
Missing Authorization vulnerability in Supsystic Ultimate Maps by Supsystic allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Ultimate Maps by Supsystic: from n/a through 1.5.3.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS