Unauthenticated API Key Disclosure in WP Go Maps Plugin by WordPress

CVE-2023-6777

Summary

The WP Go Maps plugin for WordPress contains a vulnerability that allows unauthenticated users to access the developer's Google API key. This weakness exists in versions up to and including 9.0.34 as the plugin improperly exposes the API key in multiple plugin files. Although the security of individual sites relying on this plugin is not compromised, attackers may leverage this exposure to make excessive requests using the key, potentially depleting its usage quota. This could lead to the disruption of the map functionality provided by the plugin, thereby impacting user experience.

References