CVE-2025-11166 is a CSRF vulnerability in the WP Go Maps WordPress plugin affecting all versions up to and including 9.0.46. The plugin exposes state-changing REST API endpoints through an AJAX bridge without enforcing CSRF token validation. Furthermore, some destructive operations are accessible via GET requests without permission checks. This design flaw enables attackers to force authenticated administrators to perform unauthorized actions on map data and allows unauthenticated users to delete markers en masse. The vulnerability is classified under CWE-352 and has a medium severity rating with a CVSS 3.1 score of 5.4.

The vulnerability allows attackers to perform unauthorized state-changing actions on the plugin's map data. Authenticated administrators can be tricked into creating, updating, or deleting markers and geometry features without their consent. Moreover, anonymous users can exploit unsafe GET requests to cause mass deletion of markers. This can lead to data loss and disruption of map functionality within affected WordPress sites.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, administrators should consider disabling the WP Go Maps plugin or restricting access to administrative accounts to trusted users only. Avoid clicking on untrusted links while logged in as an administrator. Monitor official vendor channels for updates and apply patches promptly once released.