Authorization Bypass in WP Go Maps Plugin by WordPress

CVE-2026-12238

What is CVE-2026-12238?

The WP Go Maps plugin for WordPress suffers from an authorization bypass vulnerability, affecting all versions up to and including 10.1.01. This flaw stems from inadequate checks to verify user authorization, allowing unauthenticated attackers to create arbitrary records within the plugin's database. By manipulating the phpClass parameter and using WPGMZA-namespaced class names, attackers can exploit the lack of proper validation. Consequently, they can insert various elements such as maps, markers, and shapes, posing a significant security risk for affected installations.

References