PT-2025-41330 · WordPress · Wp Go Maps

Dmitry Ignatyev · Published 2025-10-09 · Updated 2025-11-08 · CVE-2025-11166

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L

Name of the Vulnerable Software and Affected Versions WP Go Maps plugin for WordPress versions prior to 9.0.46

Description The WP Go Maps plugin for WordPress is susceptible to Cross-Site Request Forgery (CSRF). The plugin exposes state-changing REST actions through an AJAX bridge without appropriate CSRF token validation. Destructive logic is reachable via GET requests without permission checks. This allows unauthenticated attackers to force logged-in administrators to create, update, or delete markers and geometry features through CSRF attacks. Anonymous users can trigger mass deletion of markers via unsafe GET requests.

Recommendations Update the WP Go Maps plugin to a version later than 9.0.46.

Fix

CSRF

Weakness Enumeration

CWE-352

Related Identifiers

CVE-2025-11166

Affected Products

Wp Go Maps

References · 9

• https://nvd.nist.gov/vuln/detail/CVE-2025-11166 · Security Note
• https://wordfence.com/threat-intel/vulnerabilities/id/840ba5b2-838a-455a-b39d-865f89c05249?source=cve · Note
• https://plugins.trac.wordpress.org/browser/wp-google-maps/trunk/includes/class.rest-api.php#L45 · Note
• https://plugins.trac.wordpress.org/browser/wp-google-maps/trunk/includes/class.rest-api.php#L850 · Note
• https://twitter.com/VulmonFeeds/status/1976154187780988941 · Twitter Post
• https://reddit.com/r/u_ZiradielR13/comments/1orygtq/threat_feed_integration · Reddit Post
• https://plugins.trac.wordpress.org/browser/wp-google-maps/trunk/includes/class.rest-api.php#L287 · Note
• https://research.cleantalk.org/cve-2025-11166 · Note
• https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=3370954%40wp-google-maps%2Ftrunk&old=3317391%40wp-google-maps%2Ftrunk&sfp_email=&sfph_mail=#file1 · Note