This vulnerability is a Cross‑Site Request Forgery flaw found in the WordPress WP Go Maps plugin up to version 9.0.40. The weakness (CWE‑352) allows an attacker to craft a request that the victim's browser will send to the site while the victim is authenticated. If successful, the attacker can trigger any action the authenticated user is allowed to perform within the plugin, potentially altering map data, changing settings, or exposing sensitive information. The impact is limited to what the authenticated user can accomplish, but it could lead to data loss or unauthorized configuration changes.

The flaw affects the WP Go Maps plugin (both Basic and Pro editions) released by Codecabin for WordPress. Any installation of the plugin at version 9.0.40 or earlier is vulnerable.

The CVSS score of 4.3 indicates moderate risk, while the EPSS score of less than 1% shows a low probability of exploitation in the wild. The vulnerability is not listed in the CISA KEV catalog. Because CSRF requires a victim to be logged into the site, the attacker needs only to entice the user to visit a malicious page that triggers the forged request. No additional system privileges are required, so the exploitation is confined to the privileged actions within the plugin.