WP Go Maps (formerly WP Google Maps) Missing Authorization Vulnerability in Map Engine Setting Modification

A vulnerability exists in the WP Go Maps (formerly WP Google Maps) plugin for WordPress, in all versions through 10.0.04. The issue arises from a lack of proper capability checks in the processBackgroundAction() function, allowing authenticated attackers with Subscriber-level access and above to unauthorizedly modify global map engine settings.

Impact

Exploitation of this vulnerability allows for unauthorized modification of global map engine settings, potentially leading to misconfigurations or abuse of map-related features.

Remediation

Users are advised to update the WP Go Maps plugin to version 10.0.05 or a newer patched version.