CVE-2025-67535 MEDIUM

CVE-2025-67535: WordPress WP Maps plugin <= 4.8.6 - PHP Object Injection vulnerability

Vendor Flipper Code - Wordpress Development Company
Product WP Maps
Weakness CWE-502 · Unsafe deserialization
Published December 9, 2025
Last update April 28, 2026
View on NVD All CVEs

CVSS base score

6.6/10
Attack vector Network
Attack complexity High
Privileges required High
User interaction None
Confidentiality High
Integrity High

CVSS vector

CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H

What the vulnerability does

01Description

Deserialization of Untrusted Data vulnerability in Flipper Code - WordPress Development Company WP Maps wp-google-map-plugin allows Object Injection.This issue affects WP Maps: from n/a through <= 4.8.6.

Explanation of Vulnerability in Simple Terms

02Summary

WP Maps versions 4.8.6 and earlier contain a deserialization vulnerability in how the plugin processes untrusted data. An authenticated attacker with high privileges can craft malicious serialized input to execute arbitrary code on the site. The attack requires high attack complexity and administrative-level access to exploit.

What an attacker can do

03Attacker Capabilities

Run arbitrary code on the site with the privileges of the WordPress installation.

Potential impact on your site

04Site Impact

A compromised admin account could lead to full site takeover, data theft, or malware injection.

Conditions required to exploit

05Prerequisites

Attacker must have high-level WordPress privileges (typically administrator role) and craft a malicious serialized payload.

Key dates

06Disclosure timeline

December 9, 2025 CVE published
April 28, 2026 Record updated