CVE-2026-12238: WP Go Maps <= 10.1.01 - Unauthenticated Arbitrary Record Creation
The WP Go Maps – Most Popular Map Plugin plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 10.1.01. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated attackers to create arbitrary records in plugin database tables (maps, markers, circles, polygons, polylines, rectangles, and point labels) by supplying a WPGMZA-namespaced CRUD-backed class name via the phpClass parameter. The namespace validation check (requiring the 'WPGMZA' prefix) does not prevent exploitation because classes such as WPGMZA\Map and WPGMZA\Marker satisfy it while still triggering an INSERT into the corresponding plugin table before the route rejects the request.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Compensating control
Create a WAF or webserver rule to block or deny HTTP requests that include a phpClass parameter with a WPGMZA namespace value (e.g., phpClass values beginning with 'WPGMZA'). Drop or return 403 for requests where the phpClass parameter matches the pattern '^WPGMZA'.
- Compensating control
Restrict access to WP Go Maps CRUD endpoints so that only authenticated and authorized users may perform create/update actions. At the webserver, WAF, or application layer, deny unauthenticated POST/PUT requests that invoke plugin CRUD functionality or that supply a phpClass parameter.
- Operational
Audit and remediate plugin database tables for WP Go Maps: inspect maps, markers, circles, polygons, polylines, rectangles, and point labels tables for unauthorized or suspicious entries created by unauthenticated requests. Remove or restore unauthorized records from backups and verify integrity of remaining data.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-12238?
The severity of CVE-2026-12238 is classified as medium with a score of 5.3.
How do I fix CVE-2026-12238?
To fix CVE-2026-12238, update the WP Go Maps plugin to version 10.1.02 or later.
What kind of vulnerability is CVE-2026-12238?
CVE-2026-12238 is an authorization bypass vulnerability allowing unauthenticated arbitrary record creation.
Which systems are affected by CVE-2026-12238?
CVE-2026-12238 affects all versions of the WP Go Maps plugin up to and including version 10.1.01.
Can CVE-2026-12238 be exploited remotely?
Yes, CVE-2026-12238 can be exploited remotely by unauthenticated attackers.