CVE-2025-11999: WordPress Add Multiple Marker Plugin Flaw

CVE-2025-11999 Overview

CVE-2025-11999 affects the Add Multiple Marker plugin for WordPress in all versions up to and including 1.2. The vulnerability results from missing capability checks on the addmultiplemarker_reset_map() and amm_save_map_api() functions. Unauthenticated attackers can invoke these functions over the network to modify the map API configuration and reset stored maps. The issue is categorized as Missing Authorization [CWE-862] and requires no user interaction or privileges to exploit.

Critical Impact
Unauthenticated remote attackers can update the map API key and reset map data on any WordPress site running Add Multiple Marker plugin versions through 1.2.

Affected Products

Add Multiple Marker plugin for WordPress — all versions through 1.2
WordPress sites with the plugin installed and activated
Fixed in the changeset published at revision 3433258

Discovery Timeline

2025-11-11 - CVE-2025-11999 published to the National Vulnerability Database (NVD)
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-11999

Vulnerability Analysis

The Add Multiple Marker plugin registers two functions, addmultiplemarker_reset_map() and amm_save_map_api(), that perform state-changing operations. Both functions are exposed through WordPress AJAX or REST endpoints but omit capability checks such as current_user_can() and lack nonce validation. As a result, any client — including unauthenticated visitors — can trigger these actions by sending a crafted HTTP request to the plugin's endpoint. The Exploit Prediction Scoring System (EPSS) probability is 0.264%, placing this issue in the 17.836 percentile of exploitation likelihood.

Root Cause

The root cause is the absence of authorization enforcement in the two functions [CWE-862]. WordPress requires developers to gate sensitive AJAX handlers with capability checks and nonce verification. The plugin registers the handlers using wp_ajax_nopriv_ hooks, or equivalent unauthenticated endpoints, but never validates that the caller has the manage_options capability before writing configuration or resetting map data.

Attack Vector

An attacker sends an HTTP POST request to the WordPress AJAX endpoint (/wp-admin/admin-ajax.php) with the action parameter set to the vulnerable handler name. Because no authentication or nonce is required, the request succeeds from any external network location. Successful invocation of amm_save_map_api() overwrites the plugin's stored map API key, while addmultiplemarker_reset_map() clears saved map data. This affects site integrity by allowing attackers to substitute their own API keys or wipe legitimate map configuration.

The vulnerable functions can be reviewed in the WordPress Plugin Code Functions source tree, and the corrective patch is documented in the WordPress Plugin Changeset Update.

Detection Methods for CVE-2025-11999

Indicators of Compromise

Unexpected POST requests to /wp-admin/admin-ajax.php with action=addmultiplemarker_reset_map or action=amm_save_map_api from unauthenticated sessions
Sudden changes to the plugin's stored map API key in the WordPress wp_options table
Reset or empty map marker data on pages that previously rendered populated maps
Requests to plugin endpoints originating from IP addresses without associated authenticated session cookies

Detection Strategies

Inspect web server access logs for POST requests targeting the two vulnerable actions and correlate against authenticated user sessions
Enable WordPress audit logging to record changes to plugin option values, particularly the map API configuration
Monitor for anomalous modification timestamps on the wp_options records associated with the Add Multiple Marker plugin

Monitoring Recommendations

Configure a web application firewall (WAF) rule to alert on unauthenticated calls to the addmultiplemarker_reset_map and amm_save_map_api actions
Track the Wordfence Vulnerability Analysis advisory for updated indicators
Establish alerting on plugin option changes outside of scheduled maintenance windows

How to Mitigate CVE-2025-11999

Immediate Actions Required

Update the Add Multiple Marker plugin to a version newer than 1.2 that includes the fix from changeset 3433258
If a patched version is not yet available, deactivate and remove the plugin from affected WordPress installations
Rotate any map API keys that were configured through the plugin, since attackers may have overwritten them with attacker-controlled values
Audit map content on all public pages and restore any reset marker data from backup

Patch Information

The vendor addressed the missing authorization checks in the changeset published at WordPress Plugin Changeset Update. Administrators should upgrade to the release that incorporates this changeset. Verify the installed version through the WordPress admin plugin list after applying the update.

Workarounds

Restrict access to /wp-admin/admin-ajax.php at the WAF layer for the specific action parameters addmultiplemarker_reset_map and amm_save_map_api when the request lacks a valid authenticated session
Apply IP allowlisting to the WordPress admin interface where operationally feasible
Disable the plugin until the patched version can be validated and deployed

bash

# Example WAF rule (ModSecurity) blocking unauthenticated calls to the vulnerable actions
SecRule REQUEST_URI "@endsWith /wp-admin/admin-ajax.php" \
  "chain,phase:2,deny,status:403,id:1011999,msg:'Block CVE-2025-11999 unauthenticated AMM actions'"
  SecRule ARGS:action "@rx ^(addmultiplemarker_reset_map|amm_save_map_api)$" \
    "chain"
    SecRule &REQUEST_COOKIES:/wordpress_logged_in_/ "@eq 0"