CVE-2025-11703

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-11703", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "state": "PUBLISHED", "assignerShortName": "Wordfence", "dateReserved": "2025-10-13T18:54:06.234Z", "datePublished": "2025-10-18T06:42:46.103Z", "dateUpdated": "2026-04-08T16:52:58.001Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T16:52:58.001Z"}, "affected": [{"vendor": "wpgmaps", "product": "WP Go Maps (formerly WP Google Maps)", "versions": [{"version": "0", "status": "affected", "lessThanOrEqual": "9.0.48", "versionType": "semver"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "The WP Go Maps (formerly WP Google Maps) plugin for WordPress is vulnerable to Cache Poisoning in all versions up to, and including, 9.0.48. This is due to the plugin not serving cached data from server-side responses and instead relying on user-input. This makes it possible for unauthenticated attackers to poison the cache location for location search results."}], "title": "WP Go Maps (formerly WP Google Maps) <= 9.0.48 - Unauthenticated Cache Poisoning", "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/531360c6-e78a-4344-be06-95735337a2d6?source=cve"}, {"url": "https://research.cleantalk.org/cve-2025-11703"}, {"url": "https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3378871%40wp-google-maps&new=3378871%40wp-google-maps&sfp_email=&sfph_mail="}, {"url": "https://github.com/CodeCabin/wp-google-maps/pull/1087/files"}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-349 Acceptance of Extraneous Untrusted Data With Trusted Data", "cweId": "CWE-349", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N", "baseScore": 5.3, "baseSeverity": "MEDIUM"}}], "credits": [{"lang": "en", "type": "finder", "value": "Dmitrii Ignatyev"}], "timeline": [{"time": "2025-10-13T19:09:41.000Z", "lang": "en", "value": "Vendor Notified"}, {"time": "2025-10-17T17:52:24.000Z", "lang": "en", "value": "Disclosed"}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-10-20T18:43:21.200444Z", "id": "CVE-2025-11703", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-10-20T18:45:13.127Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-11703", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2025-10-20T18:43:21.200444Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-10-20T18:45:07.367Z"}}], "cna": {"title": "WP Go Maps (formerly WP Google Maps) <= 9.0.48 - Unauthenticated Cache Poisoning", "credits": [{"lang": "en", "type": "finder", "value": "Dmitrii Ignatyev"}], "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 5.3, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"}}], "affected": [{"vendor": "wpgmaps", "product": "WP Go Maps (formerly WP Google Maps)", "versions": [{"status": "affected", "version": "*", "versionType": "semver", "lessThanOrEqual": "9.0.48"}], "defaultStatus": "unaffected"}], "timeline": [{"lang": "en", "time": "2025-10-13T19:09:41.000Z", "value": "Vendor Notified"}, {"lang": "en", "time": "2025-10-17T17:52:24.000Z", "value": "Disclosed"}], "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/531360c6-e78a-4344-be06-95735337a2d6?source=cve"}, {"url": "https://research.cleantalk.org/cve-2025-11703"}, {"url": "https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3378871%40wp-google-maps&new=3378871%40wp-google-maps&sfp_email=&sfph_mail="}, {"url": "https://github.com/CodeCabin/wp-google-maps/pull/1087/files"}], "descriptions": [{"lang": "en", "value": "The WP Go Maps (formerly WP Google Maps) plugin for WordPress is vulnerable to Cache Poisoning in all versions up to, and including, 9.0.48. This is due to the plugin not serving cached data from server-side responses and instead relying on user-input. This makes it possible for unauthenticated attackers to poison the cache location for location search results."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-349", "description": "CWE-349 Acceptance of Extraneous Untrusted Data With Trusted Data"}]}], "providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2025-10-18T06:42:46.103Z"}}}, "cveMetadata": {"cveId": "CVE-2025-11703", "state": "PUBLISHED", "dateUpdated": "2025-10-20T18:45:13.127Z", "dateReserved": "2025-10-13T18:54:06.234Z", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "datePublished": "2025-10-18T06:42:46.103Z", "assignerShortName": "Wordfence"}, "dataVersion": "5.1"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "WP Go Maps (formerly WP Google Maps)", "vendor": "wpgmaps", "versions": [{"lessThanOrEqual": "9.0.48", "status": "affected", "version": "0", "versionType": "semver"}]}], "source": "security@wordfence.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "The WP Go Maps (formerly WP Google Maps) plugin for WordPress is vulnerable to Cache Poisoning in all versions up to, and including, 9.0.48. This is due to the plugin not serving cached data from server-side responses and instead relying on user-input. This makes it possible for unauthenticated attackers to poison the cache location for location search results."}, {"lang": "es", "value": "El plugin WP Go Maps (anteriormente WP Google Maps) para WordPress es vulnerable a envenenamiento de cach\u00e9 en todas las versiones hasta la 9.0.48, inclusive. Esto se debe a que el plugin no sirve datos en cach\u00e9 de respuestas del lado del servidor y en su lugar depende de la entrada del usuario. Esto hace posible que atacantes no autenticados envenenen la ubicaci\u00f3n de la cach\u00e9 para los resultados de b\u00fasqueda de ubicaciones."}], "id": "CVE-2025-11703", "lastModified": "2026-10-08T22:10:00.563", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 1.4, "source": "security@wordfence.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-11703", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2025-10-20T18:43:21.200444Z", "version": "2.0.3"}}]}, "published": "2025-10-18T07:15:35.883", "references": [{"source": "security@wordfence.com", "url": "https://github.com/CodeCabin/wp-google-maps/pull/1087/files"}, {"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3378871%40wp-google-maps&new=3378871%40wp-google-maps&sfp_email=&sfph_mail="}, {"source": "security@wordfence.com", "url": "https://research.cleantalk.org/cve-2025-11703"}, {"source": "security@wordfence.com", "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/531360c6-e78a-4344-be06-95735337a2d6?source=cve"}], "sourceIdentifier": "security@wordfence.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-349"}], "source": "security@wordfence.com", "type": "Secondary"}]}

{}

{"analysis": {"en": {"generated_at": "2026-04-22T12:43:20.137233+00:00", "value": {"mitigation_remediation": ["Upgrade the WP Go Maps plugin to the latest version (9.0.49 or newer).", "Reconfigure or disable client\u2011side caching for location search features to enforce server\u2011side caching.", "Audit site logs for anomalous requests and periodically purge or reset caches to mitigate potential poisoning."], "summary": {"action": "Update Plugin", "impact": "Cache Poisoning"}, "threat_synthesis": {"affected_systems": "WP Go Maps (formerly WP Google Maps) plugin for WordPress, versions up to and including 9.0.48 are vulnerable. Any WordPress site running this plugin before upgrading to 9.0.49 or newer is affected.", "description_and_impact": "The plugin fails to serve cached data from server\u2011side responses and instead trusts user input, allowing unauthenticated attackers to inject malicious content into the cache for location search results. This leads to integrity violations, potentially delivering arbitrary data to site visitors. The weakness is a Cache Poisoning flaw (CWE\u2011349).", "risk_and_exploitability": "The CVSS score of 5.3 reflects moderate risk. An EPSS score of less than 1% indicates a low likelihood of exploitation at the time of analysis, and the vulnerability is not listed in CISA KEV. Because the flaw relies solely on user input, the attack vector is likely unrestricted network traffic, but the modest score and low exposure probability suggest a moderate threat level that warrants timely remediation."}}}}, "created": "2025-10-20T13:21:36.487149+00:00", "updated": "2026-04-22T12:45:17.030814+00:00", "vendors": ["wordpress", "wordpress$PRODUCT$wordpress", "wpgmaps", "wpgmaps$PRODUCT$wp_go_maps", "wpgmaps$PRODUCT$wp_google_maps"]}