CVE-2021-25081

MEDIUM

WP Google Map < 1.8.4 - Cross-Site Request Forgery via AJAX Actions

Title source: llm
STIX 2.1

Description

The Maps Plugin using Google Maps for WordPress plugin before 1.8.4 does not have CSRF checks in most of its AJAX actions, which could allow attackers to make logged in admins delete arbitrary posts and update the plugin's settings via a CSRF attack

References (2)

Core 2
Core References
Exploit, Third Party Advisory x_refsource_misc
https://wpscan.com/vulnerability/f85cf258-1c2f-444e-91e5-b1fc55880f0e
Release Notes, Third Party Advisory x_refsource_confirm
https://plugins.trac.wordpress.org/changeset/2667376

Scores

CVSS v3 6.5
EPSS 0.0057
EPSS Percentile 42.9%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N

Details

CWE
CWE-352
Status published
Products (1)
wpgooglemap/wp_google_map < 1.8.4
Published Feb 28, 2022
Tracked Since Feb 18, 2026