CVE-2025-11166
Unknown Unknown - Not Provided

BaseFortify

Publication date: 2025-10-09

Last updated on: 2025-10-09

Assigner: Wordfence

Description
The WP Go Maps (formerly WP Google Maps) plugin for WordPress is vulnerable to Cross-Site Request Forgery (CSRF) in all versions up to, and including, 9.0.46. This is due to the plugin exposing state-changing REST actions through an AJAX bridge without proper CSRF token validation, and having destructive logic reachable via GET requests with no permission_callback. This makes it possible for unauthenticated attackers to force logged-in administrators to create, update, or delete markers and geometry features via CSRF attacks, and allows anonymous users to trigger mass deletion of markers via unsafe GET requests.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2025-10-09
Last Modified
2025-10-09
Generated
2026-07-06
AI Q&A
2025-10-09
EPSS Evaluated
2026-07-05
NVD
CVE-2025-11166
EUVD
EUVD-2025-33264

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
wp_google_maps wp_google_maps 9.0.47
wp_google_maps wp_google_maps 9.0.46

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-352 The web application does not, or cannot, sufficiently verify whether a request was intentionally provided by the user who sent the request, which could have originated from an unauthorized actor.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability affects the WP Go Maps WordPress plugin (up to version 9.0.46) and is a Cross-Site Request Forgery (CSRF) issue. The plugin exposes state-changing REST actions through an AJAX bridge without proper CSRF token validation, and destructive actions can be triggered via GET requests without permission checks. This allows attackers to trick logged-in administrators into creating, updating, or deleting map markers and geometry features, and lets anonymous users cause mass deletion of markers.

Impact Analysis

The vulnerability can lead to unauthorized changes to map data on a WordPress site using the WP Go Maps plugin. Attackers can force administrators to modify or delete map markers and geometry features without their consent, and anonymous users can trigger mass deletion of markers. This can disrupt website functionality, cause data loss, and potentially damage the site's integrity and user trust.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2025-11166. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart