Unauthorized Data Modification in WordPress Plugin by Vendor
CVE-2025-11999

5.3MEDIUM

Key Information:

Vendor

WordPress
Status
Add Multiple Marker
Vendor
CVE Published:
11 November 2025

What is CVE-2025-11999?

The Add Multiple Marker plugin for WordPress has a security flaw that allows unauthorized users to modify data due to inadequate capability checks on critical functions. Specifically, the functions addmultiplemarker_reset_map() and amm_save_map_api() lack necessary verifications, enabling unauthenticated attackers to alter the map API and reset maps, posing a risk to website integrity.

Affected Version(s)

Add Multiple Marker * <= 1.2

References

https://www.wordfence.com/threat-intel/vulnerabilities/id...
https://plugins.trac.wordpress.org/browser/add-multiple-m...
https://tinyurl.com/2bcmmpxb

CVSS V3.1

Score:
5.3
Severity:
MEDIUM
Confidentiality:
None
Integrity:
Low
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Hardik Patel
JSON
.
CVE-2025-11999 : Unauthorized Data Modification in WordPress Plugin by Vendor