What is the CVSS score of EUVD-2026-60788?

EUVD-2026-60788 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.5%.

Which versions of Easy Google Maps are affected by EUVD-2026-60788?

The Easy Google Maps WordPress plugin (Supsystic, versions ≤1.13.0) contains a critical unauthenticated vulnerability that allows attackers to inject and execute arbitrary code on affected websites…

How to fix or mitigate EUVD-2026-60788?

Within 24 hours: Inventory all WordPress installations using Easy Google Maps by Supsystic, confirm versions running 1.13.0 or earlier, and disable or remove the plugin from production environments where operationally feasible. Within 7 days: Contact Supsystic directly for patched version availability and timeline; if no patch is forthcoming within 48 hours, begin evaluation and testing of alternative map plugins in a staging environment and document the migration plan. Within 30 days: Deploy either a vendor-released patched version of Easy Google Maps (if available) or complete migration to a confirmed secure alternative; validate all website functionality post-deployment and review access logs for any exploitation attempts during the remediation window.

Easy Google Maps EUVD-2026-60788

| CVE-2026-73366 CRITICAL

Deserialization of Untrusted Data (CWE-502)

2026-08-18 Patchstack

GHSA-7qxw-c7q6-ppwj

PHP WordPress Deserialization Google Easy Google Maps Wordpress Plugin Supsystic

9.8

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

8.1 HIGH

Unauthenticated network reach (AV:N/PR:N/UI:N), but successful object injection depends on a reachable POP gadget chain, a real complexity factor warranting AC:H; full impact assumed when such a chain exists.

3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Aug 18, 2026 - 15:02 vuln.today

CVE Published

Aug 18, 2026 - 14:00 cve.org

CRITICAL 9.8

DescriptionCVE.org

Unauthenticated PHP Object Injection in Easy Google Maps <= 1.13.0 versions.

Articles & Coverage 1

News Critical PHP Object Injection in Easy Google Maps Plugin ≤1.13.0 - CVE-2026-73366 Aug 19, 2026

AnalysisAI

Unauthenticated PHP object injection affects the Easy Google Maps WordPress plugin (vendor Supsystic) in all versions up to and including 1.13.0, letting remote attackers submit arbitrary serialized PHP objects that the application deserializes. Reported by Patchstack and rated CVSS 9.8, the flaw can escalate to remote code execution, data theft, or full site takeover when a suitable property-oriented programming (POP) gadget chain is present in the plugin, WordPress core, or another active extension. No public exploit is identified at time of analysis, and the issue is not listed in CISA KEV.

Technical ContextAI

The root cause is CWE-502, deserialization of untrusted data. WordPress plugins frequently pass attacker-influenced input (request parameters, cookies, or stored options) to PHP's unserialize(), which instantiates arbitrary objects and fires magic methods such as __wakeup(), __destruct(), and __toString(). Easy Google Maps is a map embed/management plugin by Supsystic (CPE cpe:2.3:a:supsystic:easy_google_maps, plugin slug google-maps-easy) built on the standard WordPress plugin/AJAX API. PHP object injection is only directly harmful when a usable POP gadget chain exists in loaded code; the injected object's lifecycle methods are then chained to reach sensitive sinks such as file writes, SQL, command execution, or arbitrary option updates.

RemediationAI

No vendor-released patch version is identified in the provided data, so consult the Patchstack advisory (https://patchstack.com/database/wordpress/plugin/google-maps-easy/vulnerability/wordpress-easy-google-maps-plugin-1-13-0-php-object-injection-vulnerability) for the fixed release and upgrade Easy Google Maps to a version later than 1.13.0 as the primary fix once available. Until then, effective compensating controls include deactivating and removing the plugin (trade-off: all map embeds break site-wide), deploying a WAF or Patchstack virtual patch rule that blocks serialized PHP object payloads such as request values containing O:<len>: or a:<len>: patterns on the plugin's endpoints (side effect: possible false positives on legitimate serialized data), and restricting access to the plugin's AJAX/REST endpoints to trusted IPs where feasible. Additionally audit logs for exploitation indicators and rotate secrets if compromise is suspected, since object injection can enable option tampering.