CVE-2021-25011

CVE-2021-25011: WP Google Map < 1.8.1 - Subscriber+ Arbitrary Post Deletion and Plugin's Settings Update

Vendor Unknown
Product Maps Plugin using Google Maps for WordPress – WP Google Map
Weakness CWE-862 · Missing authorization
Published February 28, 2022
Last update August 3, 2024

CVSS base score

What the vulnerability does

01Description

The Maps Plugin using Google Maps for WordPress plugin before 1.8.1 does not have proper authorisation and CSRF in most of its AJAX actions, which could allow any authenticated users, such as subscriber to delete arbitrary posts and update the plugin's settings.

Key dates

02Disclosure timeline

February 28, 2022 CVE published
August 3, 2024 Record updated