CVE-2021-25081CWE-352

WP Google Map < 1.8.4 - Arbitrary Post Deletion and Plugin's Settings Update via CSRF

published February 28, 2022

CVSS
—
EPSS
1%
Percentile
46.7
In the wild
Unconfirmed
What it is

The Maps Plugin using Google Maps for WordPress plugin before 1.8.4 does not have CSRF checks in most of its AJAX actions, which could allow attackers to make logged in admins delete arbitrary posts and update the plugin's settings via a CSRF attack

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.00575 · 46.7th percentile
Weakness
CWE-352 · Cross-Site Request Forgery (CSRF)
Published
2022-02-28T09:06Z
EPSS history
Timeline
  • 28 FEB 09:06Z
    WP Google Map < 1.8.4 - Arbitrary Post Deletion and Plugin's Settings Update via CSRF
    cvelistv5