Object Injection Vulnerability in WP Maps Plugin by WePlugins
CVE-2025-67535

6.5MEDIUM

Key Information:

Vendor

WordPress
Status
WP Maps
Vendor
CVE Published:
9 December 2025

What is CVE-2025-67535?

The WP Maps plugin developed by WePlugins is vulnerable to a deserialization of untrusted data, which can lead to object injection attacks. This vulnerability affects all versions from n/a up to and including 4.8.6. Exploitation of this flaw can allow attackers to inject malicious objects, potentially compromising site integrity and security. It is crucial for users of the WP Maps plugin to update to the latest version and implement security best practices to mitigate risks.

Affected Version(s)

WP Maps <= n/a

References

https://vdp.patchstack.com/database/Wordpress/Plugin/wp-g...
vdb-entry

CVSS V3.1

Score:
6.5
Severity:
MEDIUM
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Local
Attack Complexity:
Low
Privileges Required:
High
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

kr0no | Patchstack Bug Bounty Program
JSON
.