EUVD-2026-38063
GHSA-68w4-qxch-r794
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Network-reachable REST API requires no authentication or special conditions; only low-integrity INSERT writes to plugin tables, with no confidentiality or availability impact.
Primary rating from Vendor (Wordfence).
CVSS VectorVendor: Wordfence
Lifecycle Timeline
2DescriptionCVE.org
The WP Go Maps - Most Popular Map Plugin plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 10.1.01. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated attackers to create arbitrary records in plugin database tables (maps, markers, circles, polygons, polylines, rectangles, and point labels) by supplying a WPGMZA-namespaced CRUD-backed class name via the phpClass parameter. The namespace validation check (requiring the 'WPGMZA' prefix) does not prevent exploitation because classes such as WPGMZA\Map and WPGMZA\Marker satisfy it while still triggering an INSERT into the corresponding plugin table before the route rejects the request.
AnalysisAI
Authorization bypass in the WP Go Maps WordPress plugin (all versions up to and including 10.1.01) permits unauthenticated remote attackers to insert arbitrary records into plugin-managed database tables - maps, markers, circles, polygons, polylines, rectangles, and point labels - by exploiting a race condition between namespace validation and query execution in the plugin's REST API. The flaw exists because the WPGMZA prefix check in the phpClass parameter validation passes for legitimate plugin classes such as WPGMZA\Map and WPGMZA\Marker, which trigger a SQL INSERT into the corresponding table before the route rejects the request. No public exploit has been identified at time of analysis and the vulnerability is not listed in CISA KEV, though the unauthenticated network vector and low attack complexity make it trivially abusable against the wide WordPress install base.
Technical ContextAI
The vulnerability originates in the plugin's REST API handler, observable at includes/class.rest-api.php line 1052 in the version 10.0.10 source tree on the WordPress plugin Trac. The phpClass parameter is used to instantiate a CRUD-backed plugin ORM class, gated by a namespace validation step that requires the 'WPGMZA' prefix. This check is structurally insufficient: classes like WPGMZA\Map and WPGMZA\Marker satisfy the prefix constraint while resolving to real plugin ORM classes whose constructors or methods issue SQL INSERT statements into the plugin's own database tables before the route-level rejection fires. The root cause is CWE-862 (Missing Authorization) - format validation of the class name is performed, but no capability or permission check confirms the requesting user is authorized to execute the underlying write operation. The affected CPE is cpe:2.3:a:wpgmaps:wp_go_maps_-_google_map,_openstreetmap,_leaflet_map:*:*:*:*:*:*:*:*, covering all versions through 10.1.01 across the Google Maps, OpenStreetMap, and Leaflet rendering backends.
RemediationAI
No specific patched version number is confirmed in the available intelligence data; administrators should immediately check the WordPress.org plugin repository and the Wordfence advisory at https://www.wordfence.com/threat-intel/vulnerabilities/id/c51c6cfb-9a79-4190-87ff-7eddb866ae56?source=cve for the latest release and apply any available update. As a compensating control pending a confirmed patch, restrict access to the WP Go Maps REST API namespace at the web server or WAF layer by blocking or requiring authentication on requests to the plugin's REST API routes that include a phpClass parameter - this blocks exploitation without removing the endpoint entirely, though it may affect legitimate front-end map rendering that relies on unauthenticated REST calls. Alternatively, enforcing WordPress REST API authentication globally (via a plugin such as Disable REST API, or custom capability checks) will mitigate this and similar authorization bypass vulnerabilities, at the trade-off of breaking any unauthenticated REST-dependent functionality across the site. If the WP Go Maps plugin is not actively in use, deactivating and removing it entirely eliminates the attack surface without operational impact.
More in Wordpress Plugin
View allThe Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
The Hash Form - Drag & Drop Form Builder plugin for WordPress is vulnerable to arbitrary file uploads due to missing fil
Authentication bypass in the LiteSpeed Cache WordPress plugin (versions prior to 6.5.0.1) allows unauthenticated remote
The Simple File List plugin for WordPress through version 4.2.2 contains an unauthenticated remote code execution vulner
The SureTriggers WordPress plugin through version 1.0.82 contains a privilege escalation vulnerability that allows unaut
The Ninja Forms plugin before 2.9.42.1 for WordPress allows remote attackers to conduct PHP object injection attacks via
The Business Directory Plugin - Easy Listing Directories for WordPress plugin for WordPress is vulnerable to time-based
SQL injection in the NotificationX WordPress plugin (versions up to and including 2.8.2) allows unauthenticated remote a
The POST SMTP Mailer - Email log, Delivery Failure Notifications and Best Mail SMTP for WordPress plugin for WordPress i
The MasterStudy LMS WordPress Plugin - for Online Courses and Education plugin for WordPress is vulnerable to union base
The Email Subscribers by Icegram Express plugin for WordPress is vulnerable to SQL Injection via the ‘hash’ parameter in
Remote code execution in the WP Query Console WordPress plugin (versions up to and including 1.0) by Ajit Bohra allows u
Same weakness CWE-862 – Missing Authorization
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today