Is CVE-2026-12238 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-12238 being exploited in the wild.

How severe is CVE-2026-12238?

Medium severity, with a CVSS score of 5.3, published 19 June 2026.

Which products and versions are affected?

WP Go Maps up to, and including, 10.1.01.

Is there a fix for CVE-2026-12238?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-12238 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-12238?

Check whether you run WP Go Maps at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-12238: WP Go Maps WordPress plugin authorization bypass in REST API

CVE-2026-12238 · Severity: medium · CVSS 5.3 · Published 2026-06-19

WP Go Maps, a popular WordPress plugin used for creating interactive maps, contains a security flaw that allows unauthorized users to modify map data. An attacker can remotely add unauthorized markers, shapes, or entire maps to a website without needing to log in. This could be used to deface a site's maps or inject misleading information into the geographic displays used by customers.

Technologies: WP Go Maps. Vendors: WP Go Maps.

Quick answers

Is CVE-2026-12238 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-12238 being exploited in the wild.
How severe is CVE-2026-12238?: Medium severity, with a CVSS score of 5.3, published 19 June 2026.
Which products and versions are affected?: WP Go Maps up to, and including, 10.1.01.
Is there a fix for CVE-2026-12238?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-12238 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-12238?: Check whether you run WP Go Maps at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability exists in the plugin's REST API implementation due to missing authorization checks when processing CRUD-backed classes. By supplying a 'WPGMZA' namespaced class name (such as WPGMZA\Map or WPGMZA\Marker) via the 'phpClass' parameter, an unauthenticated attacker can trigger a database INSERT operation. Although the plugin performs a namespace validation check for the 'WPGMZA' prefix, this check is insufficient as it still allows valid internal classes to execute database writes before the request is eventually rejected by the routing logic. This affects all versions up to and including 10.1.01.

Affected products

wpgmaps WP Go Maps – Most Popular Map Plugin up to, and including, 10.1.01

Timeline

2026-06-19: disclosed
2026-06-19: advisory

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.