Cross-Site Request Forgery Vulnerability in WP Go Maps Plugin for WordPress

CVE-2025-11166

What is CVE-2025-11166?

The WP Go Maps plugin for WordPress is susceptible to Cross-Site Request Forgery (CSRF) in all versions prior to 9.0.47. The vulnerability arises because state-changing REST actions are exposed via an insecure AJAX bridge that lacks proper CSRF token validation. This oversight can allow unauthenticated attackers to coerce logged-in administrators into performing unwanted actions, such as creating, updating, or deleting markers and geometry features. Furthermore, the plugin’s design permits anonymous users to execute mass deletions of markers through unsafe GET requests, posing a severe risk to website integrity.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch →

References