CVE-2021-25011
Summary
| CVE | CVE-2021-25011 |
|---|---|
| State | PUBLIC |
| Assigner | [email protected] |
| Source Priority | CVE Program / NVD first with legacy fallback |
| Published | 2022-02-28 09:15:00 UTC |
| Updated | 2022-10-25 16:41:00 UTC |
| Description | The Maps Plugin using Google Maps for WordPress plugin before 1.8.1 does not have proper authorisation and CSRF in most of its AJAX actions, which could allow any authenticated users, such as subscriber to delete arbitrary posts and update the plugin's settings. |
Risk And Classification
Problem Types: CWE-352
NVD Known Affected Configurations (CPE 2.3)
| Type | Vendor | Product | Version | Update | Edition | Language |
|---|---|---|---|---|---|---|
| Application | Wpgooglemap | Wp Google Map | All | All | All | All |
References
| Reference | Source | Link | Tags |
|---|---|---|---|
| WP Google Map < 1.8.1 - Subscriber+ Arbitrary Post Deletion and Plugin's Settings Update WordPress Security Vulnerability | MISC | wpscan.com | |
| 403 Forbidden | CONFIRM | plugins.trac.wordpress.org | |
| CVE Program record | CVE.ORG | www.cve.org | canonical |
| NVD vulnerability detail | NVD | nvd.nist.gov | canonical, analysis |
Vendor Comments And Credit
Discovery Credit
LEGACY: Krzysztof Zając
There are currently no legacy QID mappings associated with this CVE.