PT-2024-15080 · WordPress · Wp Go Maps

Danish Tariq + 2 · Published 2024-04-09 · Updated 2025-02-11 · CVE-2023-6777

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L

Name of the Vulnerable Software and Affected Versions WP Go Maps plugin for WordPress versions up to, and including, 9.0.34

Description The issue allows unauthenticated attackers to obtain the developer's Google API key due to the plugin adding the API key to several plugin files. This does not directly affect the security of sites using the plugin but enables attackers to make requests using the API key, potentially exhausting requests and resulting in an inability to use the map functionality.

Recommendations For versions up to, and including, 9.0.34, update to a version later than 9.0.34 to prevent unauthenticated API key disclosure. As a temporary workaround, consider restricting access to the plugin files that contain the API key to minimize the risk of exploitation.

Fix

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

CVE-2023-6777

Affected Products

Wp Go Maps

References · 7

• https://nvd.nist.gov/vuln/detail/CVE-2023-6777 · Security Note
• https://osv.dev/vulnerability/CVE-2023-6777 · Vendor Advisory
• https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3058300%40wp-google-maps&new=3058300%40wp-google-maps&sfp_email=&sfph_mail=#file673 · Patch
• https://wordfence.com/threat-intel/vulnerabilities/id/509cccbd-3aa0-45f1-84a0-387d678ebf65?source=cve · Note
• https://t.me/cvenotify/110833 · Telegram Post
• https://t.me/cvenotify/76225 · Telegram Post
• https://twitter.com/VulmonFeeds/status/1777818391526465901 · Twitter Post