The Add Multiple Marker plugin for WordPress does not perform a capability check in the addmultiplemarker_reset_map() and amm_save_map_api() functions, allowing an attacker to modify the map API key and reset the map without authentication. This can be used to alter how map data is displayed or to revert custom configurations back to default, effectively granting control over the plugin’s settings without proper authorization.

The vulnerability affects the krishaweb Multi Location Marker WordPress plugin in all releases up to and including version 1.2. Users running any of these versions should review their installation and determine whether the plugin is required for their site.

The CVSS score of 5.3 indicates a moderate severity. The EPSS score of less than 1% suggests very low probability of exploitation at this time, and the issue is not listed in the CISA KEV catalog. The likely attack vector is through unauthenticated HTTP requests to the vulnerable plugin endpoints; an attacker can directly send crafted requests to trigger the map reset or API key update functions without needing any credentials.