WP Go Maps CVE-2026-25466

No special conditions are required for exploitation beyond reaching the WordPress site over the network. The CVSS vector AV:N/AC:L/PR:N/UI:N/S:U confirms remote unauthenticated exploitation against any default installation of WP Go Maps 10.1.04 or earlier with a standard WordPress deployment. There is no requirement for the attacker to hold any account, trigger any user interaction, or enable a non-default configuration. The only limiting factors are: (1) impact is read-only and partial - no write or destructive capability is implied by the available data; (2) the specific data exposed depends on what map data the site owner has stored in the plugin.

The CVSS 3.1 base score of 5.3 (Medium) reflects a network-accessible, zero-authentication attack path (AV:N/AC:L/PR:N/UI:N) with limited impact confined to partial confidentiality loss (C:L/I:N/A:N/S:U). This profile means the flaw is trivially reachable and requires no attacker setup, but its real-world damage is bounded - no write capability and no availability disruption are confirmed. EPSS data was not supplied in the input, so exploitation probability cannot be quantified precisely. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog, and no public exploit code has been identified. The net risk posture is moderate: high accessibility offset by constrained impact. Sites handling sensitive map data (private location pins, internal addresses) should treat urgency as higher than the base score implies, while purely decorative map deployments face lower realistic risk.

An unauthenticated attacker - or an automated vulnerability scanner - sends a crafted HTTP GET or POST request directly to the affected WP Go Maps plugin endpoint on any publicly reachable WordPress site running version 10.1.04 or earlier. Because no authorization check gates the response, the server returns restricted data (such as saved map configurations, marker details, or internal identifiers) without requiring a session cookie or API key. No public proof-of-concept code has been identified, but the low attack complexity means exploitation could be reproduced by any attacker who reviews the plugin's source code.