CVE-2026-12238

Name of the Vulnerable Software and Affected Versions WP Go Maps versions prior to 10.1.02

Description An authorization bypass exists because the plugin fails to properly verify if a user is authorized to perform specific actions. Unauthenticated attackers can create arbitrary records in plugin database tables, including maps, markers, circles, polygons, polylines, rectangles, and point labels. This is achieved by providing a WPGMZA-namespaced CRUD-backed class name through the phpClass parameter. Although a namespace validation check requires the 'WPGMZA' prefix, classes such as WPGMZAMap and WPGMZAMarker satisfy this requirement, triggering an INSERT operation into the corresponding table before the route rejects the request.

Recommendations Update to a version later than 10.1.01.