Executive brief
WP Go Maps, a popular WordPress plugin used for creating interactive maps, contains a security flaw that allows unauthorized users to modify map data. An attacker can remotely add unauthorized markers, shapes, or entire maps to a website without needing to log in. This could be used to deface a site's maps or inject misleading information into the geographic displays used by customers.
Technical details
The vulnerability exists in the plugin's REST API implementation due to missing authorization checks when processing CRUD-backed classes. By supplying a 'WPGMZA' namespaced class name (such as WPGMZA\Map or WPGMZA\Marker) via the 'phpClass' parameter, an unauthenticated attacker can trigger a database INSERT operation. Although the plugin performs a namespace validation check for the 'WPGMZA' prefix, this check is insufficient as it still allows valid internal classes to execute database writes before the request is eventually rejected by the routing logic. This affects all versions up to and including 10.1.01.
Affected products
- wpgmaps WP Go Maps – Most Popular Map Plugin up to, and including, 10.1.01
Timeline
- 2026-06-19: disclosed
- 2026-06-19: advisory