CVE-2023-6627: 
WordPress vulnerability analysis and mitigation

The WP Go Maps (formerly WP Google Maps) WordPress plugin before version 9.0.28 contains a serious unauthenticated Stored Cross-Site Scripting (XSS) vulnerability identified as CVE-2023-6627. The vulnerability was discovered and reported by security researcher Marc Montpas, and was publicly disclosed on December 12, 2023. The issue stems from improper protection of REST API routes, which allows attackers to store malicious HTML/Javascript on affected sites without requiring authentication (WPScan Blog).

The vulnerability exists due to improper protection of REST API routes and logic bugs around decoding HTML entities in already sanitized HTML user content. The issue received a CVSS v3.1 base score of 6.1 (Medium) with vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N. The vulnerability is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation). The flaw allows attackers to bypass capability checks that would normally occur based on the HTTP method used, by exploiting the flexibility in WordPress REST API that allows users to specify both route and HTTP method through alternative means (NVD, WPScan Blog).

When successfully exploited, this vulnerability enables attackers to perform any action that a logged-in administrator is authorized to do on the targeted site. This includes critical actions such as installing arbitrary plugins and creating new rogue Administrator users. The vulnerability affects all versions of the plugin prior to 9.0.28 (WPScan Blog).

The vulnerability has been fixed in version 9.0.28 of the WP Go Maps plugin. Site administrators are strongly advised to update to this version or later to protect against this security issue. No alternative workarounds have been published (WPScan Blog).

The vulnerability was responsibly disclosed to the WP Go Maps team on December 8, 2023. The team confirmed reception of the report on December 9, 2023, and promptly released a patch on December 12, 2023, demonstrating a quick response to the security issue (WPScan Blog).