CVE-2025-11703: WP Go Maps Cache Poisoning Vulnerability

CVE-2025-11703 Overview

CVE-2025-11703 affects the WP Go Maps plugin (formerly WP Google Maps) for WordPress. The plugin fails to serve cached data from server-side responses and instead relies on user-controlled input to determine cache keys. This design flaw allows unauthenticated attackers to poison the cache location for location search results. All versions up to and including 9.0.48 are vulnerable. The issue is tracked as a cache poisoning weakness under [CWE-349: Acceptance of Extraneous Untrusted Data With Trusted Data].

Critical Impact
Unauthenticated remote attackers can manipulate cached location search results served to legitimate WordPress site visitors, undermining integrity of map data displayed on affected sites.

Affected Products

WP Go Maps (formerly WP Google Maps) WordPress plugin — all versions through 9.0.48
WordPress sites using the plugin for location search functionality
Any deployment that combines the plugin with intermediate HTTP caching layers

Discovery Timeline

2025-10-18 - CVE-2025-11703 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-11703

Vulnerability Analysis

The vulnerability originates in how WP Go Maps handles location search requests. Instead of generating cache keys from server-validated parameters, the plugin trusts user-supplied input when constructing responses that are subsequently cached. This violates the principle of separating trusted server-side data from untrusted client input.

An unauthenticated attacker can craft requests containing manipulated parameters. The plugin processes these requests and stores the tainted response in the cache. When subsequent legitimate visitors trigger the same cache key, they receive the poisoned data. The result is a persistent integrity issue that affects any visitor to the map search feature until the cache expires or is purged.

The vulnerability does not expose confidential data and does not directly degrade availability. Impact is limited to the integrity of location search results returned by the plugin. However, poisoned map data can be used for social engineering, misinformation, or as a stepping stone in broader attack chains against site users.

Root Cause

The plugin does not derive cache keys from server-side canonicalized data. It caches responses keyed by attacker-influenced input, matching [CWE-349]. See the GitHub Pull Request Files for the code changes that address the flaw.

Attack Vector

Exploitation occurs over the network with low attack complexity. The attacker needs no authentication or user interaction. They send crafted HTTP requests to the WordPress endpoint exposed by the plugin's location search feature. The manipulated response is written into the shared cache and delivered to other visitors. Refer to the CleanTalk CVE Analysis and Wordfence Vulnerability Details for exploitation context.

Detection Methods for CVE-2025-11703

Indicators of Compromise

Unexpected or inconsistent location search results returned from WP Go Maps endpoints across different clients.
Anomalous query parameters in HTTP logs targeting the plugin's REST or AJAX search routes.
Cache entries containing search responses whose payloads do not match server-side data sources.

Detection Strategies

Compare cached location search responses against expected server-side results and flag divergence.
Inspect WordPress access logs for repeated unauthenticated requests to WP Go Maps search endpoints with varied query parameters.
Audit installed plugin versions across WordPress instances and identify any WP Go Maps deployments at version 9.0.48 or earlier.

Monitoring Recommendations

Enable verbose logging on the reverse proxy or CDN layer for cache HIT and MISS events tied to plugin routes.
Alert on high volumes of unauthenticated requests targeting /wp-json/ or admin-ajax.php endpoints used by the plugin.
Track plugin update status through WordPress management tooling to confirm remediation.

How to Mitigate CVE-2025-11703

Immediate Actions Required

Update the WP Go Maps plugin to a version later than 9.0.48 that includes the fix referenced in the WordPress Plugin Changeset.
Purge existing caches at the WordPress, reverse proxy, and CDN layers to remove any poisoned entries.
Review recent HTTP logs for signs of exploitation against location search endpoints.

Patch Information

The vendor has published a fix in the WP Go Maps repository. The remediation adjusts how cached data is retrieved so that responses come from server-side sources rather than user-controlled input. Site administrators should apply the plugin update through the WordPress admin dashboard or via WP-CLI.

Workarounds

Temporarily disable the WP Go Maps plugin on sites that cannot immediately update.
Configure the caching layer to exclude WP Go Maps search endpoints from shared caches until the patch is applied.
Restrict access to plugin endpoints through a web application firewall rule that normalizes or rejects unexpected query parameters.

bash

# Configuration example: update WP Go Maps via WP-CLI and purge caches
wp plugin update wp-google-maps
wp cache flush