CVE-2025-28920: Responsive Google Map Auth Bypass Flaw

CVE-2025-28920 Overview

CVE-2025-28920 is a missing authorization vulnerability in the Jogesh Responsive Google Map WordPress plugin (responsive-google-map). The flaw affects all versions up to and including 3.1.5. Attackers can exploit incorrectly configured access control security levels to interact with plugin functionality intended for authorized users. The issue is tracked under CWE-862: Missing Authorization.

Critical Impact
Unauthenticated network-based attackers can access plugin functions that lack proper authorization checks, resulting in limited integrity impact on affected WordPress sites.

Affected Products

Jogesh Responsive Google Map plugin for WordPress
All versions from initial release through 3.1.5
WordPress sites with the responsive-google-map plugin installed and activated

Discovery Timeline

2025-03-11 - CVE-2025-28920 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-28920

Vulnerability Analysis

The Responsive Google Map plugin exposes functionality without verifying whether the requesting user has the required capability or role. This constitutes a broken access control condition classified under CWE-862. Attackers reach the vulnerable endpoints over the network without authentication or user interaction.

The impact is limited to integrity. Confidentiality and availability remain unaffected according to the published CVSS vector. This aligns with typical WordPress plugin authorization flaws where AJAX handlers or REST endpoints omit current_user_can() or nonce validation checks.

Root Cause

The root cause is the absence of authorization checks on plugin actions. WordPress plugins commonly register AJAX or REST endpoints using hooks such as wp_ajax_ and wp_ajax_nopriv_. When developers register callbacks without validating capabilities or nonces, unauthenticated requests can invoke privileged actions. Refer to the Patchstack Vulnerability Report for advisory details.

Attack Vector

Exploitation occurs over the network against a WordPress site running a vulnerable version of the plugin. An attacker sends crafted HTTP requests to the plugin's exposed endpoints. Because no authentication or user interaction is required, mass scanning and automated exploitation are feasible against publicly reachable WordPress installations.

No public proof-of-concept or exploit code has been published for CVE-2025-28920 at the time of writing. The EPSS score of 0.311% suggests limited near-term exploitation likelihood, though this can change as tooling emerges.

Detection Methods for CVE-2025-28920

Indicators of Compromise

Unauthenticated HTTP POST requests to /wp-admin/admin-ajax.php referencing responsive-google-map plugin actions
Unexpected modifications to plugin settings, map configurations, or Google Maps API keys stored in wp_options
Anomalous request patterns from single source IPs enumerating plugin AJAX actions

Detection Strategies

Inventory WordPress installations and identify sites running responsive-google-map version 3.1.5 or earlier
Review web server access logs for requests to plugin endpoints originating from unauthenticated sessions
Enable WordPress audit logging to record configuration and option changes made outside authenticated admin sessions

Monitoring Recommendations

Deploy a Web Application Firewall (WAF) rule set that flags anomalous admin-ajax.php requests targeting plugin actions
Monitor wp_options and plugin-specific database tables for changes that lack a corresponding administrator login event
Alert on spikes of HTTP 200 responses to unauthenticated plugin action calls

How to Mitigate CVE-2025-28920

Immediate Actions Required

Identify all WordPress sites running the Responsive Google Map plugin at version 3.1.5 or earlier
Update the plugin to a patched release once the vendor publishes a fix beyond version 3.1.5
Restrict administrative access paths and enforce strong authentication on all WordPress admin accounts
Review recent changes to plugin settings for signs of unauthorized modification

Patch Information

At publication, the vulnerability affects versions through 3.1.5. Administrators should consult the Patchstack Vulnerability Report for the latest fixed-version guidance and apply updates through the WordPress plugin manager.

Workarounds

Deactivate and remove the Responsive Google Map plugin until a patched version is available
Block unauthenticated requests to admin-ajax.php actions associated with the plugin using WAF or .htaccess rules
Restrict access to /wp-admin/ by source IP where operationally feasible
Replace plugin functionality with an alternative map integration that enforces authorization

bash

# Example: WAF rule pattern to block unauthenticated plugin AJAX actions
# Adapt to your WAF syntax (ModSecurity example)
SecRule REQUEST_URI "@contains /wp-admin/admin-ajax.php" \
  "chain,deny,status:403,id:1002890,msg:'Block unauth Responsive Google Map action'"
SecRule ARGS:action "@rx ^(responsive_google_map|rgm_).*" \
  "chain"
SecRule &REQUEST_COOKIES:wordpress_logged_in_* "@eq 0"