Atomic Edge analysis of CVE-2026-28144:
This vulnerability affects the WP Maps – Google Maps, OpenStreetMap, Mapbox, Store Locator, Listing, Directory & Filters plugin for WordPress, specifically in versions up to and including 4.9.6. The plugin’s AJAX handler lacks proper authorization checks, allowing any authenticated user with subscriber-level access or above to invoke sensitive administrative operations. This results in an Information Exposure vulnerability with a CVSS score of 4.3.
Root Cause: The root cause lies in the `wpgmp_ajax_call()` function, located in the plugin’s main file at `wp-google-map-plugin/wp-google-map-plugin.php` in the diff (around line 605). The function verifies a nonce using `check_ajax_referer( ‘fc-call-nonce’, ‘nonce’ )`, which only checks that the request originates from an authenticated session, but it does not verify that the user has the necessary privileges. After the nonce check, the code directly calls `$this->$operation( $value )` based on the user-supplied `operation` POST parameter. This creates an insecure direct object reference where a lower-privileged user can call sensitive internal methods such as `clean_database`, `upload_sampledata`, `save`, `map_fields`, and `cancel_import`, which are intended only for administrators.
Exploitation: An authenticated attacker with a subscriber account can exploit this by sending a POST request to the WordPress AJAX handler at `/wp-admin/admin-ajax.php`. The request must include the `action` parameter set to `wpgmp_ajax_call` (the hook for the vulnerable function), a valid nonce, and the `operation` parameter set to one of the sensitive methods, such as `save` or `map_fields`. The attacker must also obtain a valid `fc-call-nonce` nonce, which is typically localized and available on pages accessible to subscribers. By sending a crafted POST request to this endpoint, they can trigger the execution of the sensitive function and potentially extract configuration data or manipulate plugin settings.
Patch Analysis: The patch introduces an authorization check at the beginning of the `wpgmp_ajax_call()` function, after the nonce verification. It now enforces that the current user has the `manage_options` capability, which is a WordPress capability reserved for administrators. If this check fails, the function returns a 403 error. Additionally, the patch adds an allowlist of `$allowed_operations` and sanitizes the `operation` parameter using `sanitize_key()`. This prevents arbitrary method calls and ensures only the intended, safe operations can be executed, and only by privileged users.
Impact: Successful exploitation allows an authenticated subscriber to invoke privileged methods within the plugin. Depending on the specific method called, the attacker could potentially extract sensitive plugin configuration data, including API keys or map data, or alter plugin settings. The most direct impact is the exposure of sensitive information, which aligns with CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor). This information could be leveraged for further attacks against the site or its users.
