CVE-2021-25011

WP Google Map < 1.8.1 - Subscriber+ Arbitrary Post Deletion and Plugin's Settings Update

The Maps Plugin using Google Maps for WordPress plugin before 1.8.1 does not have proper authorisation and CSRF in most of its AJAX actions, which could allow any authenticated users, such as subscriber to delete arbitrary posts and update the plugin's settings.

Affected

Maps Plugin using Google Maps for WordPress – WP Google Map

CVSS v3.1 NVD

5.7 MEDIUMCVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:H/A:N

CVSS v2.0 NVD

3.5 LOWAV:N/AC:M/Au:S/C:N/I:P/A:N

EPSS

0.43% chance of exploitation in the next 30 days, 36th percentile

Published

2022-02-28

Updated

2024-08-03

Proof-of-concept exploits (1)

• https://wpscan.com/vulnerability/6639da0d-6d29-46c1-a3cc-5e5626305833

Security advisories

• https://plugins.trac.wordpress.org/changeset/2641450

References

• CVE Record
• NVD entry