wpgmaps WP Go Maps Plugin up to 9.0.34 on WordPress API Key information disclosure

Summaryinfo

A vulnerability was found in wpgmaps WP Go Maps Plugin up to 9.0.34 on WordPress. It has been rated as problematic. This issue affects some unknown processing of the component API Key Handler. The manipulation leads to information disclosure. This vulnerability is traded as CVE-2023-6777. It is possible to initiate the attack remotely. There is no exploit available.

Detailsinfo

A vulnerability was found in wpgmaps WP Go Maps Plugin up to 9.0.34 on WordPress. It has been rated as problematic. This issue affects an unknown function of the component API Key Handler. The manipulation with an unknown input leads to a information disclosure vulnerability. Using CWE to declare the problem leads to CWE-200. The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information. Impacted is confidentiality. The summary by CVE is:

The WP Go Maps (formerly WP Google Maps) plugin for WordPress is vulnerable to unauthenticated API key disclosure in versions up to, and including, 9.0.34 due to the plugin adding the API key to several plugin files. This makes it possible for unauthenticated attackers to obtain the developer's Google API key. While this does not affect the security of sites using this plugin, it allows unauthenticated attackers to make requests using this API key with the potential of exhausting requests resulting in an inability to use the map functionality offered by the plugin.

The weakness was shared by Hassan Khan Yusufzai. It is possible to read the advisory at wordfence.com. The identification of this vulnerability is CVE-2023-6777 since 12/13/2023. The exploitation is known to be easy. The attack may be initiated remotely. No form of authentication is needed for a successful exploitation. The technical details are unknown and an exploit is not publicly available. The attack technique deployed by this issue is T1592 according to MITRE ATT&CK.

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Productinfo

Type

• WordPress Plugin

Vendor

• wpgmaps

Name

• WP Go Maps Plugin

Version

• 9.0.0
• 9.0.1
• 9.0.2
• 9.0.3
• 9.0.4
• 9.0.5
• 9.0.6
• 9.0.7
• 9.0.8
• 9.0.9
• 9.0.10
• 9.0.11
• 9.0.12
• 9.0.13
• 9.0.14
• 9.0.15
• 9.0.16
• 9.0.17
• 9.0.18
• 9.0.19
• 9.0.20
• 9.0.21
• 9.0.22
• 9.0.23
• 9.0.24
• 9.0.25
• 9.0.26
• 9.0.27
• 9.0.28
• 9.0.29
• 9.0.30
• 9.0.31
• 9.0.32
• 9.0.33
• 9.0.34

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Discussion