Description

Unauthenticated PHP Object Injection in Easy Google Maps <= 1.13.0 versions.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.8",
  "pubDate": "2026-08-18T15:17:04.960Z",
  "pubdate": "2026-08-18T15:17:04.960Z",
  "executiveSummary": "An unauthenticated PHP Object Injection vulnerability exists in the Easy Google Maps plugin <= 1.13.0 versions.\nThe vulnerability allows remote, unauthenticated attackers to supply maliciously crafted serialized data to vulnerable endpoints processed by the application.\nSuccessful exploitation of this security flaw can lead to severe impacts, potentially including arbitrary file deletion, remote code execution, or data tampering depending on the application context and the presence of compatible gadget chains within the PHP environment.\nThe risk implication is critical due to the lack of authentication requirements, enabling automated exploitation vectors over the network.\nAttackers do not require prior access or privileged credentials, only network connectivity to the target web application running the affected software version.",
  "technicalDetails": "The vulnerability stems from insecure deserialization practices within the Easy Google Maps plugin <= 1.13.0 versions.\nRoot cause analysis indicates that user-supplied input is passed directly into native PHP deserialization functions such as unserialize() without prior sanitization, validation, or type checking.\nThe vulnerable component processes HTTP requests containing serialized objects, allowing external input to instantiate arbitrary classes defined in the application or included third-party libraries.\nAuthentication and privilege requirements are absent, meaning any unauthenticated remote user can interact with the vulnerable network-exposed endpoint.\nThe attack flow proceeds as follows: First, the attacker identifies the vulnerable HTTP endpoint responsible for processing serialized parameters. Second, the attacker crafts a malicious payload containing serialized PHP objects tailored to leverage available gadget chains. Third, the attacker transmits this payload via an HTTP request to the target server. Fourth, the application deserializes the untrusted data, invoking magic methods such as __wakeup() or __destruct() within the instantiated classes.\nPayload behavior depends heavily on the specific gadget chains present in the runtime environment, but typically facilitates post-exploitation impacts such as remote code execution, unauthorized database operations, or arbitrary file manipulation."
}