CVE-2026-73366: Easy Google Maps Auth Bypass Vulnerability

CVE-2026-73366 Overview

CVE-2026-73366 is an unauthenticated PHP Object Injection vulnerability affecting the Easy Google Maps WordPress plugin in versions up to and including 1.13.0. The flaw stems from unsafe deserialization of attacker-controlled input [CWE-502]. Remote, unauthenticated attackers can send crafted payloads to the plugin and trigger instantiation of arbitrary PHP objects. When suitable PHP magic methods or gadget chains exist in the WordPress runtime, this can lead to remote code execution, arbitrary file operations, or full site compromise.

Critical Impact
Unauthenticated attackers can inject arbitrary PHP objects into vulnerable Easy Google Maps installations, enabling code execution, data theft, and complete WordPress site takeover.

Affected Products

Easy Google Maps WordPress plugin versions <= 1.13.0
WordPress sites running the google-maps-easy plugin
Any hosting environment exposing WordPress with the affected plugin enabled

Discovery Timeline

2026-08-18 - CVE-2026-73366 published to NVD
2026-08-20 - Last updated in NVD database

Technical Details for CVE-2026-73366

Vulnerability Analysis

The vulnerability is a PHP Object Injection issue classified under CWE-502: Deserialization of Untrusted Data. The Easy Google Maps plugin passes attacker-controlled input to a PHP deserialization routine such as unserialize() without validating that the input comes from a trusted source. When PHP reconstructs the serialized objects, it invokes magic methods such as __wakeup() or __destruct() on the resulting instances.

Attackers reuse existing classes loaded by WordPress core, themes, or other plugins as gadget chains. These chains can chain method calls to reach dangerous sinks including file writes, SQL execution, and command invocation. The attack requires no authentication and no user interaction, and the plugin exposes the vulnerable entry point over the network.

Root Cause

The root cause is the unsafe deserialization of untrusted request data inside Easy Google Maps <= 1.13.0. The plugin fails to sanitize or reject serialized payloads before passing them to PHP object reconstruction. Once the object graph is rebuilt, PHP automatically executes magic methods on the attacker-controlled instances.

Attack Vector

The attack vector is network-based. An unauthenticated attacker sends an HTTP request containing a serialized PHP payload to a plugin endpoint that reaches the vulnerable deserialization call. The payload references gadget classes present in the target environment. Refer to the Patchstack WordPress Plugin Vulnerability advisory for technical details.

Detection Methods for CVE-2026-73366

Indicators of Compromise

HTTP request bodies or query parameters containing serialized PHP markers such as O:, a:, or s: targeting Easy Google Maps endpoints
Unexpected new administrator accounts, plugins, themes, or PHP files under wp-content/
Outbound connections from the web server to unfamiliar hosts following requests to google-maps-easy routes
Web server error log entries referencing unserialize(), __wakeup, or __destruct from the plugin path

Detection Strategies

Inspect WordPress plugin inventories for google-maps-easy at version <= 1.13.0
Deploy web application firewall signatures that flag serialized PHP object patterns in requests to WordPress endpoints
Correlate HTTP access logs with process creation events on the web host to spot post-exploitation activity
File integrity monitoring on wp-content/plugins/, wp-content/uploads/, and WordPress core directories

Monitoring Recommendations

Alert on HTTP requests to Easy Google Maps handlers containing serialized object markers
Monitor for PHP processes spawning shells, curl, wget, or python from the web user context
Track creation of new WordPress admin users or option changes to active_plugins outside change windows
Forward web server, PHP-FPM, and WordPress audit logs to a centralized SIEM for correlation

How to Mitigate CVE-2026-73366

Immediate Actions Required

Update Easy Google Maps to a fixed release above 1.13.0 as soon as the vendor publishes a patched version
Deactivate and remove the google-maps-easy plugin if a patched version is not yet available
Rotate WordPress administrator passwords, application passwords, and secret keys in wp-config.php
Audit the site for backdoors, unknown admin accounts, and modified core files

Patch Information

Refer to the Patchstack advisory for Easy Google Maps for the current patch status and fixed version guidance. Apply the vendor-supplied update through the WordPress plugin manager once released.

Workarounds

Block requests to Easy Google Maps endpoints containing serialized PHP patterns using a WAF rule matching O:\d+:", a:\d+:{, and similar markers
Restrict access to the WordPress site to trusted IP ranges while a patch is unavailable
Disable the plugin at the filesystem level by renaming the google-maps-easy directory under wp-content/plugins/
Enforce least-privilege file permissions so the PHP process cannot write to WordPress core or plugin directories

bash

# Configuration example: disable the vulnerable plugin from the CLI
wp plugin deactivate google-maps-easy --allow-root
wp plugin delete google-maps-easy --allow-root

# Verify no residual files remain
ls -la wp-content/plugins/ | grep -i google-maps-easy