Unauthenticated Broken Access Control in WP Go Maps

Executive Summary

CVE-2026-25466 is an unauthenticated broken access control vulnerability in the WordPress WP Go Maps plugin versions 10.1.04 and earlier. It occurs due to missing authorization, authentication, or nonce token checks, allowing unauthenticated users to perform higher-privileged actions.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, check if the WP Go Maps plugin version is 10.1.04 or earlier. You can verify the installed version via WordPress admin panel under Plugins or by inspecting the plugin files on the server. No specific commands are provided in the context, but reviewing plugin versions and access logs for unusual activity may help.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability could allow unauthorized users to perform actions requiring higher privileges, though the severity is classified as low. Exploitation is unlikely in mass campaigns, but immediate action like updating the plugin or seeking developer assistance is recommended.

Useful 0 Not Useful 0

Mitigation Strategies

Immediately update the WP Go Maps plugin to the latest version if available. If no patch exists, consider disabling the plugin temporarily or seeking assistance from a hosting provider or developer. Monitor for unauthorized access or unusual activity in logs.

Useful 0 Not Useful 0