CVE-2026-12238: WP Go Maps Authorization Bypass Flaw

CVE-2026-12238 Overview

CVE-2026-12238 is an authorization bypass vulnerability in the WP Go Maps WordPress plugin (formerly WP Google Maps). The flaw affects all versions up to and including 10.1.01. Unauthenticated attackers can create arbitrary records in plugin database tables including maps, markers, circles, polygons, polylines, rectangles, and point labels. The vulnerability stems from improper authorization checks in the REST API route handler. Attackers exploit it by supplying a WPGMZA-namespaced CRUD-backed class name via the phpClass parameter. The namespace validation requiring the WPGMZA prefix executes after the database INSERT, allowing record creation before the route rejects the request.

Critical Impact
Unauthenticated attackers can inject arbitrary records into seven plugin database tables on any vulnerable WordPress site, enabling data pollution and potential abuse of map content.

Affected Products

WP Go Maps – Most Popular Map Plugin for WordPress
All versions up to and including 10.1.01
WordPress sites running the WPGMZA plugin with REST API enabled

Discovery Timeline

2026-06-19 - CVE-2026-12238 published to NVD
2026-06-24 - Last updated in NVD database

Technical Details for CVE-2026-12238

Vulnerability Analysis

The vulnerability is a Missing Authorization weakness classified under [CWE-862]. The plugin exposes a REST API endpoint that accepts a phpClass parameter naming a PHP class to instantiate. The endpoint validates that the supplied class name begins with the WPGMZA namespace prefix. However, this check is positioned incorrectly within the request handling flow. Database INSERT operations occur in the class constructor before the route's authorization logic runs. Classes such as WPGMZA\Map and WPGMZA\Marker satisfy the namespace validation while their instantiation triggers row creation in the corresponding plugin tables.

Root Cause

The root cause is misordered authorization enforcement in class.rest-api.php. The plugin instantiates the CRUD-backed class before verifying that the requesting user holds permission for the action. The namespace prefix check acts as a denylist surrogate but does not block legitimate WPGMZA CRUD classes whose constructors perform database writes. Authorization is checked too late in the execution path to prevent the side effect.

Attack Vector

The attack vector is remote and network-based, requiring no authentication and no user interaction. An attacker sends a crafted HTTP request to the plugin's REST API endpoint. The request body includes the phpClass parameter set to a valid WPGMZA CRUD class name such as WPGMZA\Marker along with attacker-controlled field values. The plugin instantiates the class, triggering an INSERT into the associated table. The request returns an error afterward, but the row persists. Refer to the WordPress Plugin Code Reference for the affected code path.

Detection Methods for CVE-2026-12238

Indicators of Compromise

Unexpected rows in WPGMZA plugin tables including wp_wpgmza, wp_wpgmza_maps, wp_wpgmza_polygon, wp_wpgmza_polylines, wp_wpgmza_circles, wp_wpgmza_rectangles, and point label tables.
POST requests to the plugin's REST API endpoints containing a phpClass parameter with values such as WPGMZA\Map or WPGMZA\Marker.
REST API requests from unauthenticated sessions that result in record creation despite returning error responses.

Detection Strategies

Audit WPGMZA database tables for records lacking expected administrator authorship or created outside normal admin workflows.
Inspect web server access logs for requests to /wp-json/wpgmza/ routes containing the phpClass query parameter.
Correlate REST API request bursts to plugin endpoints with subsequent row count increases in plugin tables.

Monitoring Recommendations

Enable WordPress request logging or a Web Application Firewall (WAF) rule to capture and alert on phpClass parameter values referencing the WPGMZA namespace.
Monitor row counts on plugin tables and alert on growth from unauthenticated source IPs.
Track HTTP responses returning errors that still produced database side effects by comparing request and database audit timelines.

How to Mitigate CVE-2026-12238

Immediate Actions Required

Update the WP Go Maps plugin to the latest patched release available after version 10.1.01 once published by the vendor.
Restrict access to the plugin's REST API endpoints at the web server or WAF layer until the patch is applied.
Review and remove unauthorized records from WPGMZA plugin tables created during the exposure window.

Patch Information

Review the Wordfence Vulnerability Report for vendor patch tracking and the fixed version once released. The vulnerable code resides in includes/class.rest-api.php and requires reordering authorization checks ahead of class instantiation.

Workarounds

Deploy a WAF rule blocking POST requests to plugin REST routes that include a phpClass parameter matching the WPGMZA\ namespace.
Disable the WP Go Maps plugin until a vendor patch is available if maps are not business-critical.
Restrict access to /wp-json/ endpoints to authenticated administrators using server-level access controls.

bash

# Example WAF/Nginx rule to block exploitation attempts
location ~* /wp-json/wpgmza/ {
    if ($request_method = POST) {
        if ($request_body ~* "phpClass.*WPGMZA") {
            return 403;
        }
    }
}