CVE-2025-11703 WP Go Maps (formerly WP Google Maps) <= 9.0.48 - Unauthenticated Cache Poisoning
Unauthenticated attackers can poison the cache for location search results in the WP Go Maps WordPress plugin by exploiting reliance on user input for cached data.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2025-11703?
CVE-2025-11703 is a medium-severity vulnerability in wpgmaps WP Go Maps (formerly WP Google Maps), published on 18 Oct 2025. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
The WP Go Maps (formerly WP Google Maps) plugin for WordPress is vulnerable to Cache Poisoning in all versions up to, and including, 9.0.48. This is due to the plugin not serving cached data from server-side responses and instead relying on user-input. This makes it possible for unauthenticated attackers to poison the cache location for location search results.
Weakness: CWE-349
Which versions are affected by CVE-2025-11703?
How do I fix CVE-2025-11703?
No fix has been published for CVE-2025-11703 yet. Limit exposure of the affected software until one is available.
Is CVE-2025-11703 being exploited?
There is no known exploitation of CVE-2025-11703 in the wild and no public exploit code.
Sources
Also known as GHSA-gc56-w3pr-7w7f.