CVE-2025-11703 describes a cache poisoning vulnerability in the WP Go Maps WordPress plugin up to version 9.0.48. The plugin improperly serves cached data by relying on user input rather than server-side responses, enabling unauthenticated attackers to manipulate cache entries for location search results. This is classified under CWE-349, which involves acceptance of extraneous untrusted data with trusted data. The vulnerability has a CVSS 3.1 base score of 5.3, indicating medium severity with network attack vector, low attack complexity, no privileges required, and no user interaction needed. The impact is limited to integrity, with no confidentiality or availability impact reported. No known exploits in the wild or patches are documented in the provided information.

The vulnerability allows unauthenticated attackers to poison cache entries for location search results, potentially causing users to receive manipulated or incorrect location data. This impacts data integrity but does not affect confidentiality or availability. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no patch or official fix is indicated, users should monitor the vendor's communications for updates. Until a fix is available, consider disabling or limiting the use of the affected plugin to reduce exposure.