Cross-Site Request Forgery Vulnerability in WP Go Maps Plugin for WordPress

CVE-2025-11166

What is CVE-2025-11166?

The WP Go Maps plugin for WordPress is susceptible to Cross-Site Request Forgery (CSRF) in all versions prior to 9.0.47. The vulnerability arises because state-changing REST actions are exposed via an insecure AJAX bridge that lacks proper CSRF token validation. This oversight can allow unauthenticated attackers to coerce logged-in administrators into performing unwanted actions, such as creating, updating, or deleting markers and geometry features. Furthermore, the plugin’s design permits anonymous users to execute mass deletions of markers through unsafe GET requests, posing a severe risk to website integrity.

References