CVE-2023-6777

The WP Go Maps (formerly WP Google Maps) plugin for WordPress is vulnerable to unauthenticated API key disclosure in versions up to, and including, 9.0.34 due to the plugin adding the API key to several plugin files. This makes it possible for unauthenticated attackers to obtain the developer's Google API key. While this does not affect the security of sites using this plugin, it allows unauthenticated attackers to make requests using this API key with the potential of exhausting requests resulting in an inability to use the map functionality offered by the plugin.

CVSS v3 5.3 MEDIUM

5.3^/10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 3.9 / Impact : 1.4

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact LOW

Scope UNCHANGED

References

Link	Resource
https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3058300%40wp-google-maps&new=3058300%40wp-google-maps&sfp_email=&sfph_mail=#file673	Patch
https://www.wordfence.com/threat-intel/vulnerabilities/id/509cccbd-3aa0-45f1-84a0-387d678ebf65?source=cve	Third Party Advisory
https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3058300%40wp-google-maps&new=3058300%40wp-google-maps&sfp_email=&sfph_mail=#file673	Patch
https://www.wordfence.com/threat-intel/vulnerabilities/id/509cccbd-3aa0-45f1-84a0-387d678ebf65?source=cve	Third Party Advisory

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:codecabin:wp_go_maps:::::basic:wordpress::
	cpe:2.3:a:codecabin:wp_go_maps:::::pro:wordpress::

History

11 Feb 2025, 15:56

Type	Values Removed	Values Added
First Time		Codecabin wp Go Maps Codecabin
CPE		cpe:2.3:a:codecabin:wp_go_maps:::::pro:wordpress:: cpe:2.3:a:codecabin:wp_go_maps:::::basic:wordpress::
References	~~() https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3058300%40wp-google-maps&new=3058300%40wp-google-maps&sfp_email=&sfph_mail=#file673 -~~	() https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3058300%40wp-google-maps&new=3058300%40wp-google-maps&sfp_email=&sfph_mail=#file673 - Patch
References	~~() https://www.wordfence.com/threat-intel/vulnerabilities/id/509cccbd-3aa0-45f1-84a0-387d678ebf65?source=cve -~~	() https://www.wordfence.com/threat-intel/vulnerabilities/id/509cccbd-3aa0-45f1-84a0-387d678ebf65?source=cve - Third Party Advisory
CWE		NVD-CWE-noinfo

21 Nov 2024, 08:44

Type	Values Removed	Values Added
Summary		(es) El complemento WP Go Maps (anteriormente WP Google Maps) para WordPress es vulnerable a la divulgación de claves API no autenticadas en versiones hasta la 9.0.34 incluida debido a que el complemento agrega la clave API a varios archivos de complemento. Esto hace posible que atacantes no autenticados obtengan la clave API de Google del desarrollador. Si bien esto no afecta la seguridad de los sitios que utilizan este complemento, permite a atacantes no autenticados realizar solicitudes utilizando esta clave API con el potencial de agotar las solicitudes, lo que resulta en la imposibilidad de utilizar la funcionalidad de mapas que ofrece el complemento.
References	~~() https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3058300%40wp-google-maps&new=3058300%40wp-google-maps&sfp_email=&sfph_mail=#file673 -~~	() https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3058300%40wp-google-maps&new=3058300%40wp-google-maps&sfp_email=&sfph_mail=#file673 -
References	~~() https://www.wordfence.com/threat-intel/vulnerabilities/id/509cccbd-3aa0-45f1-84a0-387d678ebf65?source=cve -~~	() https://www.wordfence.com/threat-intel/vulnerabilities/id/509cccbd-3aa0-45f1-84a0-387d678ebf65?source=cve -

09 Apr 2024, 19:15

Type	Values Removed	Values Added
New CVE

Information

Published : 2024-04-09 19:15

Updated : 2025-02-11 15:56

NVD link : CVE-2023-6777

Mitre link : CVE-2023-6777

CVE.ORG link : CVE-2023-6777

JSON object : View

Products Affected

codecabin

wp_go_maps

CWE

NVD-CWE-noinfo

{"id": "CVE-2023-6777", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Secondary", "source": "security@wordfence.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "LOW", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 1.4, "exploitabilityScore": 3.9}, {"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.5, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "LOW", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}, "impactScore": 2.5, "exploitabilityScore": 3.9}]}, "published": "2024-04-09T19:15:12.743", "references": [{"url": "https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3058300%40wp-google-maps&new=3058300%40wp-google-maps&sfp_email=&sfph_mail=#file673", "tags": ["Patch"], "source": "security@wordfence.com"}, {"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/509cccbd-3aa0-45f1-84a0-387d678ebf65?source=cve", "tags": ["Third Party Advisory"], "source": "security@wordfence.com"}, {"url": "https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3058300%40wp-google-maps&new=3058300%40wp-google-maps&sfp_email=&sfph_mail=#file673", "tags": ["Patch"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/509cccbd-3aa0-45f1-84a0-387d678ebf65?source=cve", "tags": ["Third Party Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "NVD-CWE-noinfo"}]}], "descriptions": [{"lang": "en", "value": "The WP Go Maps (formerly WP Google Maps) plugin for WordPress is vulnerable to unauthenticated API key disclosure in versions up to, and including, 9.0.34 due to the plugin adding the API key to several plugin files. This makes it possible for unauthenticated attackers to obtain the developer's Google API key. While this does not affect the security of sites using this plugin, it allows unauthenticated attackers to make requests using this API key with the potential of exhausting requests resulting in an inability to use the map functionality offered by the plugin."}, {"lang": "es", "value": "El complemento WP Go Maps (anteriormente WP Google Maps) para WordPress es vulnerable a la divulgaci\u00f3n de claves API no autenticadas en versiones hasta la 9.0.34 incluida debido a que el complemento agrega la clave API a varios archivos de complemento. Esto hace posible que atacantes no autenticados obtengan la clave API de Google del desarrollador. Si bien esto no afecta la seguridad de los sitios que utilizan este complemento, permite a atacantes no autenticados realizar solicitudes utilizando esta clave API con el potencial de agotar las solicitudes, lo que resulta en la imposibilidad de utilizar la funcionalidad de mapas que ofrece el complemento."}], "lastModified": "2025-02-11T15:56:04.650", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:codecabin:wp_go_maps:*:*:*:*:basic:wordpress:*:*", "vulnerable": true, "matchCriteriaId": "072ED9A4-77F3-4D92-95FA-03C8CF894CA9", "versionEndExcluding": "9.0.35"}, {"criteria": "cpe:2.3:a:codecabin:wp_go_maps:*:*:*:*:pro:wordpress:*:*", "vulnerable": true, "matchCriteriaId": "6A783D3A-3D85-430E-B3FC-FB51208290C5", "versionEndExcluding": "9.0.35"}], "operator": "OR"}]}], "sourceIdentifier": "security@wordfence.com"}

5.3 /10