External risk intelligence

Ultimate Maps by Supsystic Unauthenticated PHP Object Injection

CVE advisorySeverity: CRITICAL (CVSS 9.8)

CVE-2026-73376

This vulnerability affects a WordPress plugin, which functions as a web application component. Web plugins are commonly deployed on public-facing web servers and are designed to be accessible to internet traffic, making the attack surface frequently exposed to the public internet.

Deserialization

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A critical security flaw has been identified in a widely used WordPress plugin, potentially allowing unauthorized access and manipulation of systems. This vulnerability could enable attackers to compromise the integrity and availability of services without needing any credentials. The main concern is to confirm if this plugin is in use within the organization and if it is exposed to external access.

Unauthenticated PHP code injection risk.
Affects a common website component.
Confirm usage and exposure.

Attack Path

How an attacker could exploit the issue

An unauthenticated attacker can exploit this PHP Object Injection vulnerability by sending specially crafted data to a vulnerable component of Ultimate Maps by Supsystic. This could lead to the attacker achieving remote code execution on the server.

No authentication required to attack.
Triggered by sending malicious data.
Allows full server compromise.

Live Threat

Current exploitation, exposure, and threat context

This vulnerability could allow an unauthenticated attacker to execute arbitrary PHP code on a server running an affected version of Ultimate Maps by Supsystic. This could occur when the plugin processes unsanitized input, potentially leading to a compromise of the web application and its hosted data.

Server-side code execution.
Via unsanitized plugin input.
Complete web application compromise.

Operational Fix

Recommended remediation, mitigation, and detection steps

This unauthenticated PHP Object Injection vulnerability affects a WordPress plugin, indicating that application owners and platform teams are likely responsible for managing its remediation. The first practical step involves identifying all instances of the affected plugin, determining their reachability and business criticality, and then assigning ownership for risk-based planning.

Application owners should investigate installations.
Verify plugin presence and network exposure.
Plan remediation based on identified risks.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is the Ultimate Maps by Supsystic plugin?

It is a WordPress plugin used to create and manage interactive maps on websites. Developers and site administrators install it to display store locators, contact pages, or geographical data visualizations directly within a WordPress environment. Because it is a web application component, it interacts frequently with user input to render map features.

What does PHP Object Injection mean for CVE-2026-73376?

This vulnerability belongs to the 'Deserialization of Untrusted Data' weakness class (CWE-502). It happens when the plugin incorrectly processes serialized data provided by a user. Instead of safely handling the information, the application inadvertently creates objects that an attacker can manipulate to run unauthorized commands or access sensitive areas of the server.

How is this vulnerability triggered?

An attacker triggers this by sending specially crafted, malicious data to the vulnerable plugin component. Because the flaw is unauthenticated, the attacker does not need to log into the website to initiate the request. Standard navigation or legitimate map viewing by site visitors will not trigger this issue; it requires a specific, intentionally malformed input sent to the plugin's data processing logic.

Is my site at risk according to Halo Surface Signal?

Halo Surface Signal identifies this as a high-concern vulnerability because WordPress plugins function as web application components. Since these are often deployed on public-facing servers intended to be reachable by internet traffic, they naturally reside on an attack surface that is frequently exposed. If your instance is connected to the public internet, it falls into this likely-exposed category.

Do I need to take action if I use this plugin?

Yes, start by identifying all websites under your management that have this plugin installed. Once you confirm its presence, check the version number to see if it is older than 1.5.0. After locating the affected instances, determine which are reachable via the internet and prioritize them for updates or removal to mitigate the risk of server compromise.

References

patchstack.com/database/wordpress/plugin/ultimate-maps-by-supsystic/…

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.