WP Go Maps EUVD-2026-38063

The target WordPress site must have WP Go Maps installed and active at version 10.1.01 or earlier, and the WordPress REST API must be publicly accessible - which is the default configuration for all standard WordPress installations. No authentication is required, no non-default plugin configuration must be enabled, and no specific WordPress theme or co-installed plugin is needed. Exploitation is bounded by the fact that the attacker can only INSERT new records into the six plugin-owned tables (maps, markers, circles, polygons, polylines, rectangles, point labels); existing records cannot be read, modified, or deleted through this flaw, and WordPress core database tables are not reachable. The WPGMZA namespace prefix requirement limits usable phpClass values to actual plugin classes but does not prevent exploitation, as multiple valid plugin ORM classes satisfy the check while still issuing database writes.

The vendor-assigned CVSS 3.1 score of 5.3 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N) accurately models the risk profile: trivially exploitable from the network with no authentication or user interaction, but constrained to low-integrity writes into plugin-owned tables with no confidentiality or availability consequences per the vector. No EPSS data was included in the available intelligence feed, preventing probabilistic exploitation likelihood assessment. The vulnerability is absent from CISA KEV and no POC code is referenced, indicating no confirmed active exploitation at time of analysis. Despite the moderate score, two factors elevate practical concern: the attack requires a single crafted HTTP request with no prerequisites beyond a reachable WordPress REST API (which is default-on), and the WordPress ecosystem's scale means automated scanning against large numbers of sites could pollute map data across many installations simultaneously. The primary real-world impact - database table pollution degrading rendered maps - is meaningful for sites where maps are business-critical, though it does not constitute a data breach or service outage by itself.

An unauthenticated attacker identifies a WordPress site running WP Go Maps ≤10.1.01 through passive plugin enumeration (e.g., checking /wp-content/plugins/wp-google-maps/ for accessible assets), then sends a single crafted HTTP POST to the plugin's REST API endpoint with the phpClass parameter set to WPGMZA\Marker and arbitrary marker field values. The namespace check passes, an INSERT into the plugin's markers table fires before the route-level rejection, and a spurious marker record is permanently written to the database - requiring no credentials and producing no error visible to the attacker beyond a rejected response body.