CVE-2025-11166: WP Go Maps Plugin CSRF Vulnerability

CVE-2025-11166 Overview

The WP Go Maps plugin (formerly WP Google Maps) for WordPress contains a Cross-Site Request Forgery (CSRF) vulnerability affecting all versions up to and including 9.0.46. The plugin exposes state-changing REST actions through an AJAX bridge without proper CSRF token validation. Destructive logic is also reachable via GET requests with no permission_callback defined. Unauthenticated attackers can force logged-in administrators to create, update, or delete markers and geometry features. Anonymous users can also trigger mass deletion of markers via unsafe GET requests. This vulnerability is tracked as CWE-352: Cross-Site Request Forgery.

Critical Impact
Anonymous attackers can trigger mass deletion of map markers and geometry data, and can coerce authenticated administrators into performing unauthorized state-changing actions on affected WordPress sites.

Affected Products

WP Go Maps (formerly WP Google Maps) WordPress plugin — all versions up to and including 9.0.46
WordPress sites with the vulnerable plugin installed and active
Any environment where administrators may authenticate to the WordPress dashboard while browsing untrusted content

Discovery Timeline

2025-10-09 - CVE-2025-11166 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-11166

Vulnerability Analysis

The vulnerability originates in the plugin's REST API implementation in class.rest-api.php. The plugin registers state-changing endpoints via an AJAX bridge that does not validate WordPress nonces or CSRF tokens. Attackers can craft malicious pages that trigger authenticated requests when visited by a logged-in administrator.

A second, more severe issue is present: destructive operations are reachable through GET requests without a permission_callback. Any unauthenticated visitor can issue a request that deletes markers or geometry features. This bypasses the authentication requirement entirely for the destructive path.

The combination of missing CSRF protection on privileged actions and missing authorization checks on destructive GET handlers means the plugin fails two independent security controls on the same code path.

Root Cause

The root cause is twofold. First, REST actions exposed through the AJAX bridge lack check_ajax_referer or equivalent nonce validation. Second, REST route registrations omit permission_callback, which WordPress requires to enforce authorization. Without it, endpoints default to public access. State-changing operations were also mapped to HTTP GET, allowing browsers to trigger them via simple image tags or redirects.

Attack Vector

Exploitation requires no authentication for the anonymous deletion path. An attacker sends a crafted GET request to the vulnerable REST endpoint, either directly or by embedding the URL in third-party content. For the CSRF path, an attacker hosts a malicious page containing an auto-submitting form or embedded resource targeting the AJAX bridge. When a logged-in administrator visits the page, the browser sends session cookies and executes the state-changing action. Technical details are documented in the CleanTalk CVE-2025-11166 analysis and the Wordfence vulnerability report.

No verified proof-of-concept code has been published. See the affected REST API source in the WordPress plugin repository for the vulnerable handler registration.

Detection Methods for CVE-2025-11166

Indicators of Compromise

Unexpected deletion of markers, polygons, polylines, or geometry features from WP Go Maps configurations without corresponding administrator activity in the audit log
HTTP GET requests to WP Go Maps REST routes under /wp-json/wpgmza/ or the AJAX endpoint admin-ajax.php with action parameters targeting marker or geometry operations from unauthenticated sources
Referer headers on state-changing requests originating from external domains not associated with the WordPress administrator

Detection Strategies

Review WordPress access logs for GET requests to WP Go Maps REST endpoints that perform delete, create, or update operations, especially from anonymous sources
Compare current marker counts and geometry records against known-good backups to identify unauthorized modifications
Enable and monitor WordPress activity logging plugins to capture the identity performing marker changes

Monitoring Recommendations

Alert on HTTP 200 responses to WP Go Maps REST routes that lack an authenticated session cookie or valid nonce parameter
Track anomalous spikes in requests to /wp-json/wpgmza/ endpoints from single source IPs or referers
Correlate administrator dashboard sessions with outbound clicks to untrusted URLs that could deliver CSRF payloads

How to Mitigate CVE-2025-11166

Immediate Actions Required

Update the WP Go Maps plugin to a version later than 9.0.46 as soon as the vendor releases a patched build
Audit existing marker and geometry data for unauthorized deletion or modification
Restrict administrative access to the WordPress dashboard using IP allowlists or VPN-gated access

Patch Information

The vendor has published code changes in the plugin trunk. Review the WordPress plugin changeset for the specific fixes applied. Confirm installed plugin version is above 9.0.46 before considering remediation complete.

Workarounds

Deactivate the WP Go Maps plugin until a patched version is installed if map functionality is not business-critical
Deploy a Web Application Firewall (WAF) rule to block unauthenticated GET requests to WP Go Maps REST routes that perform state changes
Enforce a strict Content Security Policy and use SameSite=Lax or SameSite=Strict cookies to reduce CSRF exposure on authenticated sessions
Require administrators to log out of the WordPress dashboard when not actively performing management tasks

bash

# Example nginx rule to block unauthenticated GET to vulnerable REST paths
location ~ ^/wp-json/wpgmza/ {
    if ($request_method = GET) {
        return 403;
    }
}