CVE-2021-25081

Published: Feb 28, 2022Modified: Jun 17, 2026

6.5

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N

Exploitability: 2.8 / Impact: 3.6

Source: NVD

Description

The Maps Plugin using Google Maps for WordPress plugin before 1.8.4 does not have CSRF checks in most of its AJAX actions, which could allow attackers to make logged in admins delete arbitrary posts and update the plugin's settings via a CSRF attack

Affected (1)

Products: Wpgooglemap: Wp Google Map

Wpgooglemap

1 product

Wp Google Map

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Wpgooglemap Wp Google Map	Before 1.8.4

Related CWEs

CWE-352

Cross-Site Request Forgery (CSRF)

The web application does not, or can not, sufficiently verify whether a well-formed, valid, consistent request was intentionally provided by the user who submitted the request.

References (4)

https://plugins.trac.wordpress.org/changeset/2667376

Source: contact@wpscan.com

Release NotesThird Party Advisory

https://wpscan.com/vulnerability/f85cf258-1c2f-444e-91e5-b1fc55880f0e

Source: contact@wpscan.com

ExploitThird Party Advisory

https://plugins.trac.wordpress.org/changeset/2667376

Source: af854a3a-2127-422b-91ae-364da2661108

Release NotesThird Party Advisory

https://wpscan.com/vulnerability/f85cf258-1c2f-444e-91e5-b1fc55880f0e

Source: af854a3a-2127-422b-91ae-364da2661108

ExploitThird Party Advisory

Timeline

No history available yet.