WP Go Maps – Most Popular Map Plugin for WordPress suffers from an authorization bypass that allows anyone without authentication to create entries in any of the plugin’s database tables, including maps, markers, circles, polygons, polylines, rectangles, and point labels. The flaw originates from an inadequate verification of the phpClass parameter, which accepts classes prefixed with "WPGMZA" (such as WPGMZA\Map or WPGMZA\Marker). When a request contains a valid class name, the plugin performs an INSERT into the corresponding table before rejecting the request for lack of permission, thus enabling unprivileged data injection.

All WordPress installations that have the WP Go Maps plugin version 10.1.01 or earlier are affected. The vulnerability impacts sites that rely on this plugin for displaying Google Maps, OpenStreetMap, or Leaflet overlays and expose the plugin’s REST API to the public network.

The CVSS score of 5.3 indicates a moderate severity, but the exploit is straightforward for an attacker with network access to the WordPress site. No EPSS data is available, and the vulnerability is not listed in the CISA KEV catalog. Attackers can exploit the flaw by sending a crafted REST API request that includes a phpClass parameter pointing to a valid WPGMZA class; the plugin will then create a new database record before denying the request, thus bypassing authentication controls.