The WP Go Maps plugin contains a Cross‑Site Request Forgery flaw in all versions up to 9.0.46. The plugin exposes state‑changing REST actions through an AJAX bridge that lacks proper CSRF token validation and, for certain routes, permits destructive logic to be triggered via GET requests without a permission_callback. Consequently, an unauthenticated attacker can trick a logged‑in administrator into creating, updating, or deleting map markers and geometry features, and an anonymous user can invoke a mass deletion of all markers through unsafe GET requests.

All installations of the WP Go Maps (formerly WP Google Maps) plugin with a version number 9.0.46 or earlier are impacted. The vulnerability affects the plugin’s REST API endpoints that handle marker and geometry CRUD operations.

The CVSS score of 5.4 indicates a moderate severity. The EPSS score is less than 1 percent, implying a very low current exploitation probability, and the vulnerability is not listed in CISA’s KEV catalog. The flaw can be exploited via a standard CSRF attack vector, meaning an attacker only needs to host a malicious page that submits a forged request to the known endpoints. Permissions are not required, and the attack can be carried out on any WordPress site running a vulnerable plugin version, regardless of whether the attacker is authenticated.