Thanh Điềm

**Name of the Vulnerable Software and Affected Versions** WP Go Maps versions prior to 10.1.02 **Description** An authorization bypass exists because the plugin fails to properly verify if a user is authorized to perform specific actions. Unauthenticated attackers can create arbitrary records in plugin database tables, including maps, markers, circles, polygons, polylines, rectangles, and point labels. This is achieved by providing a WPGMZA-namespaced CRUD-backed class name through the `phpClass` parameter. Although a namespace validation check requires the 'WPGMZA' prefix, classes such as `WPGMZAMap` and `WPGMZAMarker` satisfy this requirement, triggering an INSERT operation into the corresponding table before the route rejects the request. **Recommendations** Update to a version later than 10.1.01.