CVE-2026-25466 WPGMaps CVE debrief

Who should care

Defenders responsible for WordPress installations using the WP Go Maps plugin should assess exposure and prioritize verification and potential updates.

Why it matters

CVE-2026-25466 is a medium-severity vulnerability in the WP Go Maps plugin that allows unauthenticated broken access control. Defenders responsible for WordPress installations using this plugin should assess exposure and prioritize verification and potential updates to prevent potential exploitation.

• Verify the version of the WP Go Maps plugin in use to determine potential exposure
• Update to a patched version if necessary to prevent potential exploitation
• Monitor for potential exploitation attempts to detect potential security incidents

Technical summary

CVE-2026-25466 is a medium-severity vulnerability in the WP Go Maps plugin, affecting versions up to 10.1.04. It allows unauthenticated broken access control, which could potentially be exploited to access sensitive information. The CVSS score is 5.3, with a vector of CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N.

Defensive priority

Defenders should prioritize verifying the version of the WP Go Maps plugin in use and updating to a patched version if necessary.

Recommended defensive actions

• Verify the version of the WP Go Maps plugin in use
• Update to a patched version if necessary
• Monitor for potential exploitation attempts

Evidence notes

The CVE record and NVD entry provide limited information about the vulnerability, with the NVD entry currently listed as 'Deferred'.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.