CVE-2025-24742: WP Go Maps CSRF Vulnerability

CVE-2025-24742 Overview

CVE-2025-24742 is a Cross-Site Request Forgery (CSRF) vulnerability in the WP Go Maps plugin (formerly WP Google Maps) developed by WPGMaps / Codecabin for WordPress. The flaw affects all plugin versions from initial releases through 9.0.40. An attacker can trick an authenticated user into submitting forged state-changing requests to the plugin, leading to compromise of confidentiality, integrity, and availability of the affected WordPress site. The vulnerability is classified under CWE-352: Cross-Site Request Forgery and requires user interaction such as clicking a malicious link.

Critical Impact
Successful exploitation lets attackers perform privileged plugin actions on behalf of an authenticated WordPress user, potentially altering map configurations, injecting content, or modifying site state.

Affected Products

WP Go Maps (Basic) for WordPress — versions through 9.0.40
WP Go Maps (Pro) for WordPress — versions through 9.0.40
Codecabin wp_go_maps plugin (wp-google-maps)

Discovery Timeline

2025-01-27 - CVE-2025-24742 published to NVD
2026-04-23 - Last updated in NVD database

Technical Details for CVE-2025-24742

Vulnerability Analysis

The vulnerability stems from missing or insufficient anti-CSRF protections in the WP Go Maps plugin. State-changing endpoints exposed by wp-google-maps accept authenticated requests without verifying a valid WordPress nonce or origin. An attacker hosting an attacker-controlled page can craft an HTML form or JavaScript fetch request that targets the plugin's administrative actions. When a logged-in administrator or privileged user visits the page, the browser automatically attaches session cookies, and the forged request executes under that user's authority.

Because the plugin manages map data, markers, settings, and embedded content rendered to site visitors, abuse of these endpoints affects site integrity. The attacker does not need credentials, only a victim with an active WordPress session and the willingness to follow a link or load an external resource. This combination of network reach, low complexity, and high impact aligns with the [CWE-352] weakness classification.

Root Cause

The root cause is the absence of proper request authenticity validation on plugin actions. WordPress provides wp_verify_nonce() and check_admin_referer() helpers to bind requests to a specific user session. Endpoints in WP Go Maps through 9.0.40 do not consistently enforce these checks, allowing cross-origin requests to be processed as if they originated from the legitimate admin interface.

Attack Vector

Exploitation requires an authenticated WordPress user to interact with attacker-controlled content. The attacker delivers a phishing link, malicious advertisement, or compromised third-party page containing an auto-submitting form pointing at the vulnerable plugin endpoint. When the victim's browser submits the request, WordPress session cookies authorize the action, and the plugin performs the requested change without origin verification.

The vulnerability is described in prose only. Refer to the Patchstack CSRF Vulnerability Report for additional technical context.

Detection Methods for CVE-2025-24742

Indicators of Compromise

Unexpected modifications to WP Go Maps configuration, markers, or map content not attributable to legitimate administrators
WordPress access logs showing POST requests to wp-google-maps endpoints with Referer headers pointing to external, untrusted domains
Administrator account activity coinciding with visits to unfamiliar URLs or email-delivered links

Detection Strategies

Inspect web server logs for requests to plugin AJAX or REST endpoints lacking a _wpnonce parameter or with mismatched Origin/Referer headers
Compare current plugin settings and database tables against known-good baselines to identify unauthorized changes
Use WordPress security plugins or audit logs to flag plugin setting modifications outside of expected change windows

Monitoring Recommendations

Enable WordPress audit logging for plugin configuration changes and administrator session activity
Forward WordPress and web server logs to a centralized SIEM for correlation of suspicious referer patterns and admin actions
Alert on plugin version drift and on requests to wp-google-maps endpoints from anonymous or external referrers

How to Mitigate CVE-2025-24742

Immediate Actions Required

Update the WP Go Maps plugin to a version newer than 9.0.40 as soon as a fixed release is available from the vendor
Audit administrator and editor accounts for unexpected configuration changes since installing affected versions
Require administrators to log out of WordPress before browsing untrusted sites and to use separate browser profiles for admin tasks

Patch Information

The vendor has not published an explicit fixed-version advisory in the referenced data. Site owners should monitor the Patchstack CSRF Vulnerability Report and the WordPress.org plugin page for an updated release that adds nonce validation to the affected endpoints.

Workarounds

Deactivate the WP Go Maps plugin until a patched version is installed if maps functionality is non-critical
Restrict access to /wp-admin/ using IP allowlists or a WAF rule that enforces same-origin Referer headers on plugin endpoints
Apply a virtual patching rule via a Web Application Firewall to block requests to wp-google-maps actions that lack a valid _wpnonce parameter

bash

# Example WAF rule concept (ModSecurity) to block cross-origin POSTs to the plugin
SecRule REQUEST_URI "@contains wp-google-maps" \
    "phase:1,deny,status:403,id:1002025,\
    chain,msg:'Block CSRF attempts against WP Go Maps (CVE-2025-24742)'"
    SecRule REQUEST_METHOD "@streq POST" \
        "chain"
        SecRule &ARGS:_wpnonce "@eq 0"