CVE-2021-25011

The Maps Plugin using Google Maps for WordPress plugin before 1.8.1 does not have proper authorisation and CSRF in most of its AJAX actions, which could allow any authenticated users, such as subscriber to delete arbitrary posts and update the plugin's settings.

CVSS v3.1

5.7 MEDIUMCVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:H/A:N

CVSS v2.0

3.5 LOWAV:N/AC:M/Au:S/C:N/I:P/A:N

EPSS

0.43% chance of exploitation in the next 30 days, 36th percentile

Published

2022-02-28

Updated

2024-08-03

Proof-of-concept exploits (1)

• https://wpscan.com/vulnerability/6639da0d-6d29-46c1-a3cc-5e5626305833

References

• CVE Record
• NVD entry

Related

• CVE-2021-25010
• CVE-2021-25012
• CVE-2021-25009
• CVE-2021-25013
• CVE-2021-25008
• CVE-2021-25014