CVE-2026-12238: WP Go Maps Authorization Bypass Vulnerability

Technical summary

CVE-2026-12238 is an authorization bypass vulnerability in WP Go Maps versions up to 10.1.01 caused by improper verification of user permissions during CRUD operations. The vulnerability is exploited via the phpClass parameter, which accepts a WPGMZA-namespaced class name. Although the plugin validates that the class name prefix matches 'WPGMZA', it performs this check before authorization verification, allowing unauthenticated attackers to instantiate objects such as WPGMZA\Map or WPGMZA\Marker. The INSERT operations complete successfully against plugin database tables (maps, markers, circles, polygons, polylines, rectangles, and point labels) before the route handler evaluates permissions. This is classified as a CWE-862 (Missing Authorization) weakness, underscoring the fundamental flaw in the authorization flow.

Business impact

Organizations running WP Go Maps are exposed to data integrity attacks that could corrupt or pollute their map-based features with malicious or nonsensical records. For websites that rely on maps for customer navigation, property listings, or location-based services, unauthorized database insertions can degrade user experience and erode trust. The attack requires no authentication, making it trivial for adversaries to conduct at scale. While the vulnerability does not grant access to sensitive data or enable system compromise, it creates operational disruption and maintenance overhead. Websites with user-generated map content may also face reputational damage if malicious markers or polygons appear to come from legitimate users.

Affected systems

WP Go Maps plugin for WordPress in all versions up to and including 10.1.01 are vulnerable. This includes all installations where the plugin is installed and activated, regardless of WordPress theme or other plugins. Standalone WordPress sites, multisite networks, and managed WordPress hosting environments running vulnerable versions are all at risk. The vulnerability is network-accessible and requires no special network positioning, so any website exposing the plugin's endpoints to the internet is affected.

Exploitability

This vulnerability is straightforward to exploit. An attacker needs only network access to the WordPress installation and knowledge of the plugin's CRUD endpoint and class name format. No authentication credentials are required, no user interaction is necessary, and exploitation does not depend on complex environment-specific conditions. The attack is reproducible and automatable, allowing adversaries to rapidly corrupt data across multiple targets. The CVSS score of 5.3 (MEDIUM) reflects the low complexity and high availability of exploit vectors, offset by the limited scope of impact (integrity of plugin data only).

Remediation

Update WP Go Maps to a patched version released after version 10.1.01. Verify the patched release by checking the official plugin repository or the vendor's security advisory. Until a patch is available, consider temporarily deactivating the plugin if it is not critical to operations. Organizations should also conduct database audits to remove any unauthorized map records that may have been inserted during the vulnerability window.

Patch guidance

Upgrade WP Go Maps to the latest available version through the WordPress plugin dashboard or via direct download from the official WordPress.org plugin repository. After upgrading, verify in the plugin changelog or vendor advisory that the update addresses CVE-2026-12238. Test the plugin functionality in a non-production environment before deploying to live sites. Monitor database records for suspicious entries added prior to patching and remove them as needed.

Detection guidance

Monitor access logs and database query logs for unexpected INSERT operations against WP Go Maps tables (wp_wpgmza_maps, wp_wpgmza_markers, wp_wpgmza_circles, wp_wpgmza_polygons, wp_wpgmza_polylines, wp_wpgmza_rectangles, wp_wpgmza_point_labels). Look for requests to the plugin's CRUD endpoints containing phpClass parameters with WPGMZA-namespaced class names originating from unauthenticated sessions. Implement Web Application Firewall (WAF) rules to block or flag requests to known vulnerable endpoints. Database integrity checks and regular backups will help identify unauthorized data modifications.

Why prioritize this

While rated MEDIUM severity, this vulnerability should be prioritized for rapid remediation because it is trivial to exploit, affects all internet-exposed instances without authentication, and can be leveraged in automated attacks. Organizations relying on map data integrity should treat this as high priority. The lack of KEV status does not diminish urgency—active exploitation is likely given the simplicity of the attack.

Risk score, explained

The CVSS v3.1 score of 5.3 reflects a network-accessible vulnerability (AV:N) with low complexity (AC:L) and no privilege requirements (PR:N), yielding moderate impact on data integrity (I:L) while excluding confidentiality and availability concerns (C:N, A:N). The score appropriately captures the risk of unauthorized data modification without system compromise or information disclosure.

Frequently asked questions