CVE-2025-11166: WP Go Maps (formerly WP Google Maps) <= 9.0.46 - Cross-Site Request Forgery to Plugin Settings Update
The WP Go Maps (formerly WP Google Maps) plugin for WordPress is vulnerable to Cross-Site Request Forgery (CSRF) in all versions up to, and including, 9.0.46. This is due to the plugin exposing state-changing REST actions through an AJAX bridge without proper CSRF token validation, and having destructive logic reachable via GET requests with no permissioncallback. This makes it possible for unauthenticated attackers to force logged-in administrators to create, update, or delete markers and geometry features via CSRF attacks, and allows anonymous users to trigger mass deletion of markers via unsafe GET requests.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-11166?
CVE-2025-11166 is classified as a medium severity Cross-Site Request Forgery vulnerability that affects WP Go Maps versions up to and including 9.0.46.
How do I fix CVE-2025-11166?
To fix CVE-2025-11166, update the WP Go Maps plugin to the latest version that addresses the CSRF vulnerability.
What types of attacks can CVE-2025-11166 enable?
CVE-2025-11166 can enable attackers to perform unauthorized actions on behalf of authenticated users through CSRF attacks.
Is my website at risk if I use WP Go Maps before version 9.0.46 due to CVE-2025-11166?
Yes, websites using WP Go Maps versions up to 9.0.46 are at risk of exploitation due to the vulnerabilities associated with CVE-2025-11166.
What should I do if I cannot update WP Go Maps to mitigate CVE-2025-11166?
If you cannot update the plugin, consider disabling it until a fix is available or implementing additional security measures to limit exposure.