CVE-2021-25011 WP Google Map < 1.8.1 - Subscriber+ Arbitrary Post Deletion and Plugin's Settings Update

2022-02-2809:06:30

CWE-862

WPScan

www.cve.org

5.9 Medium

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

21.6%

JSON

The Maps Plugin using Google Maps for WordPress plugin before 1.8.1 does not have proper authorisation and CSRF in most of its AJAX actions, which could allow any authenticated users, such as subscriber to delete arbitrary posts and update the plugin’s settings.

CNA Affected

[
  {
    "product": "Maps Plugin using Google Maps for WordPress – WP Google Map",
    "vendor": "Unknown",
    "versions": [
      {
        "lessThan": "1.8.1",
        "status": "affected",
        "version": "1.8.1",
        "versionType": "custom"
      }
    ]
  }
]