Easy Google Maps < 1.14.2 - Unauthenticated Arbitrary Remote Script Inclusion

Description

The Easy Google Maps plugin for WordPress is vulnerable to Remote File Inclusion in all versions up to 1.14.2. This is due to missing allowlist validation on the api_domain option value in the getApiDomain() function, allowing any arbitrary URL to be used as the Maps API source. This makes it possible for unauthenticated attackers to include arbitrary remote files by supplying an attacker-controlled domain as the Google Maps API domain, causing the server to load and execute scripts from an external location. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where images and other "safe" file types can be uploaded and included.