CVE-2025-39465CWE-862broken-access-control

CVE-2025-39465

Medium · published November 6, 2025

CVSS v3.1
4.3
EPSS
0%
Percentile
13.7
In the wild
Unconfirmed
What it is

⚠️ A missing authorization check in flippercode's Advanced Google Maps could leave your access control wide open! Think of it like a party with a guest list that nobody checks — anyone can walk in and grab a drink, no invitation needed! This vulnerability allows unauthorized users to exploit incorrectly configured access controls, potentially leading to unauthorized access to specific features or data. While not catastrophic, it could compromise user privacy and introduce unwanted chaos into your application.

Put simply

Think of it like a party with a guest list that nobody checks — anyone can walk in and grab a drink, no invitation needed! The flaw occurs in versions of Advanced Google Maps from n/a through 5.8.4, where the lack of proper authorization checks allows users to bypass intended access restrictions and interact with sensitive functionalities.

What to do

This vulnerability allows unauthorized users to exploit incorrectly configured access controls, potentially leading to unauthorized access to specific features or data. While not catastrophic, it could compromise user privacy and introduce unwanted chaos into your application. To secure your application, update Advanced Google Maps to the latest version, ensuring that proper access control configurations are in place. Conduct an audit of your user roles and permissions to tighten security further. You've got this! Follow these steps to strengthen your defenses and keep your application safe! 🛡️

The record
Technical detail
CVSS v3.1
4.3 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
CVSS v4.0
Not supplied
EPSS
0.00236 · 13.7th percentile
Weakness
CWE-862 · Missing Authorization
Published
2025-11-06T21:15Z
References (1)
EPSS history
Timeline
  • 06 NOV 15:53Z
    WordPress Advanced Google Maps plugin <= 5.8.4 - Broken Access Control vulnerability
    cvelistv5