CVE-2025-11166

Vulnerability

Overview

The WP Go Maps plugin for WordPress (up to version 9.0.46) exposes internal REST API endpoints through an admin-ajax.php bridge action wpgmza_rest_api_request. This bridge lacks proper CSRF token validation and, in some cases, does not enforce permission checks. The plugin allows state-changing operations (creating, updating, deleting markers and geometry features) to be reached via GET requests on a destructive route without a permission_callback. [1]

Attack

Vector

An unauthenticated attacker can exploit the CSRF weakness by tricking a logged-in administrator or editor into visiting a crafted page or clicking a malicious link. This forces the victim's browser to send forged requests that create, modify, or delete markers and geometry. Additionally, the permissive GET endpoint enables anonymous users to directly trigger mass deletion of markers without any authentication or user interaction. [1]

Impact

Successful exploitation allows an attacker to tamper with map content, potentially defacing sites or disrupting services that rely on accurate map data. The ability to mass delete markers anonymously also constitutes a denial-of-service (DoS) condition, as it can remove all map points without administrative oversight. [1]

Mitigation

The plugin vendor has been notified, and a PoC exists; affected users should update WP Go Maps to a version newer than 9.0.46 once a patched release is available. As a temporary measure, administrators can restrict access to the AJAX bridge or implement additional server-side validation, but updating is the definitive fix. [1]