CVE-2025-11166

The WP Go Maps (formerly WP Google Maps) plugin for WordPress is vulnerable to Cross-Site Request Forgery (CSRF) in all versions up to, and including, 9.0.46. This is due to the plugin exposing state-changing REST actions through an AJAX bridge without proper CSRF token validation, and having destructive logic reachable via GET requests with no permission_callback. This makes it possible for unauthenticated attackers to force logged-in administrators to create, update, or delete markers and geometry features via CSRF attacks, and allows anonymous users to trigger mass deletion of markers via unsafe GET requests.

• CWE-352

• https://plugins.trac.wordpress.org/browser/wp-google-maps/trunk/includes/class.rest-api.php#L287
• https://plugins.trac.wordpress.org/browser/wp-google-maps/trunk/includes/class.rest-api.php#L45
• https://plugins.trac.wordpress.org/browser/wp-google-maps/trunk/includes/class.rest-api.php#L850
• https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=3370954%40wp-google-maps%2Ftrunk&old=3317391%40wp-google-maps%2Ftrunk&sfp_email=&sfph_mail=#file1
• https://research.cleantalk.org/cve-2025-11166
• https://www.wordfence.com/threat-intel/vulnerabilities/id/840ba5b2-838a-455a-b39d-865f89c05249?source=cve

Published

Oct 9, 2025

Last Modified

Jun 17, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2025-11160The WPBakery Page Builder plugin for WordPress is vulnerable…5.4
• CVE-2025-11161The WPBakery Page Builder plugin for WordPress is vulnerable…5.4
• CVE-2025-11162The Spectra Gutenberg Blocks – Website Builder for the Block…6.4
• CVE-2025-11163The SmartCrawl SEO checker, analyzer & optimizer plugin for …4.3
• CVE-2025-11164The Mavix Education theme for WordPress is vulnerable to una…4.3
• CVE-2025-11165A sandbox escape vulnerability exists in dotCMS’s Velocity s…9.9
• CVE-2025-11167The CM Registration – Tailored tool for seamless login and i…4.7
• CVE-2025-11168The Mementor Core plugin for WordPress is vulnerable to Priv…8.8
• CVE-2025-1117A vulnerability, which was classified as critical, was found…7.3
• CVE-2025-11170The WP移行専用プラグイン for CPI plugin for WordPress is vulnerable t…9.8
• CVE-2025-11171The Chartify – WordPress Chart Plugin for WordPress is vulne…5.3
• CVE-2025-11172The Check Plagiarism plugin for WordPress is vulnerable to u…4.3