The WP Maps plugin in WordPress performs deserialization of untrusted data, leading to PHP object injection. An attacker who can supply crafted serialized content—such as via a request parameter or form field—can instantiate arbitrary PHP objects, potentially executing code on the server. This results in compromise of the website’s confidentiality, integrity, and availability and may grant the attacker full control of the site as the website owner. The weakness is identified as CWE‑502.

This issue affects the Flipper Code WordPress Development Company’s WP Maps plugin (wp‑google‑map‑plugin) up to and including version 4.8.6. No other vendors or versions are currently listed as vulnerable.

The CVSS score of 6.6 indicates moderate severity, while the EPSS rating of less than 1 % suggests a low probability of exploitation in the wild. The vulnerability is not listed in CISA’s KEV catalog, implying there are no known large‑scale attacks. The likely attack vector is HTTP requests that contain malicious serialized data directed at the plugin’s input endpoints. Without a patch or proper validation, the flaw provides a pathway for remote code execution.