Segurium Research Advisories wp-google-maps

WP Go Maps 10.1.08 and earlier: Other

medium Other

WP Go Maps 10.1.09 adds a bounds check on the midcbp REST parameter. In 10.1.08 and earlier, an out-of-range pointer made the Elias-Fano decode loop run past its buffer until PHP stopped the request.

Plugin
WP Go Maps wp-google-maps
Affected versions
10.1.08 and earlier
Fixed in
10.1.09
Class
Other
Severity
medium Segurium Research assessment. No CVSS score published yet.
CVE
None assigned at the time of writing
Installs
300,000 active
Patch released
Sources
Read the teardown What the release changed, how the bug worked, and what to check on a site that ran the affected version.

Segurium Research writes these up from public source after the fix has shipped. We do not scan or probe third-party sites, and no teardown here carries a working exploit. Segurium itself is a WordPress malware scanner on the official directory at wordpress.org/plugins/segurium/.