Read the docs
TI-2026-10527 Aliases CVE-2026-12238GHSA-68w4-qxch-r794

WP Go Maps <= 10.1.01 - Unauthenticated Arbitrary Record Creation

Priority LOW 30CWE-862Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Security bypass
Confidentiality · integrity · availability
None · Low · None
Fix status
No fix listed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-862.

Summary

The WP Go Maps – Most Popular Map Plugin plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 10.1.01. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated attackers to create arbitrary records in plugin database tables (maps, markers, circles, polygons, polylines, rectangles, and point labels) by supplying a WPGMZA-namespaced CRUD-backed class name via the phpClass parameter. The namespace validation check (requiring the 'WPGMZA' prefix) does not prevent exploitation because classes such as WPGMZA\Map and WPGMZA\Marker satisfy it while still triggering an INSERT into the corresponding plugin table before the route rejects the request.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00376 31st percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
wpgmapsWP Go Maps – Google Map, OpenStreetMap, Leaflet Mapup to 10.1.01—No fix listedCNA
  • WP Go Maps – Google Map, OpenStreetMap, Leaflet Map Vendorwpgmaps Affected up to 10.1.01 Fixed in — No fix listed CNA

Remediation

No fixed version listed by the sources yet.

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-12238
  2. 2026-10-03 Alias added: GHSA-68w4-qxch-r794

References

Other 2

  • TI-2024-19698 WordPress WP Go Maps plugin <= 9.0.29 - Reflected Cross Site Scripting (XSS) vulnerability CVSS 3.1HIGH 7.1
  • TI-2025-18459 WordPress WP Google Maps plugin <= 9.0.40 - Cross Site Request Forgery (CSRF) vulnerability CVSS 3.1HIGH 8.8
  • TI-2023-06192 WP Go Maps (formerly WP Google Maps) <= 9.0.34 - Information Exposure to Potential Denial of Service CVSS 3.1MEDIUM 6.5
  • TI-2026-58281 WordPress WP Go Maps plugin <= 10.1.08 - Denial of Service Attack vulnerability CVSS 3.1MEDIUM 5.3
  • TI-2026-20578 WordPress WP Go Maps plugin <= 10.1.04 - Broken Access Control vulnerability CVSS 3.1MEDIUM 5.3
  • TI-2026-00394 Missing authorization in wpgmaps WP Go Maps CVSS 3.1MEDIUM 5.3
See all 14 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences