External risk intelligence

Easy Google Maps Unauthenticated PHP Object Injection

CVE advisorySeverity: CRITICAL (CVSS 9.8)

CVE-2026-73366

The vulnerability exists in a WordPress plugin designed for public-facing web content. Plugins of this nature are commonly deployed on web servers to provide functionality to internet-accessible websites, making the vulnerable code directly reachable via standard HTTP/HTTPS requests from the public internet.

Deserialization

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

An unauthenticated PHP Object Injection vulnerability has been identified in a widely used WordPress plugin, potentially allowing for significant data compromise and system disruption. The issue stems from how the plugin handles certain data inputs, creating an opening for attackers to inject malicious code without needing any prior access or credentials. This could have broad implications for websites relying on this plugin for their mapping features.

Attackers can inject code without login.
Matters for all public-facing websites.
Confirm relevance and exposure to this plugin.

Attack Path

How an attacker could exploit the issue

An attacker can exploit this vulnerability by sending a specially crafted request to a website using the affected plugin. This request will trigger the PHP Object Injection flaw, potentially allowing the attacker to execute arbitrary code on the server.

No authentication or user interaction is needed.
Triggered by a crafted request to the plugin.
Risk of remote code execution and data compromise.

Live Threat

Current exploitation, exposure, and threat context

This vulnerability could allow an unauthenticated attacker to inject PHP objects into a vulnerable system. This may lead to the disclosure of sensitive information, manipulation of system behavior, or unauthorized code execution when the application processes these serialized objects.

System data and sensitive information could be at risk.
Unauthenticated remote code execution is possible.
Complete system compromise may occur.

Operational Fix

Recommended remediation, mitigation, and detection steps

This critical unauthenticated PHP Object Injection vulnerability in Easy Google Maps affects publicly accessible websites. Infrastructure and platform teams are likely responsible for managing the WordPress environment, while application owners and security teams should assess business criticality and exposure. The first practical step is to identify all instances of the plugin, determine their reachability and business impact, and confirm ownership before planning remediation.

Application and platform teams own remediation.
Verify plugin presence and exposure.
Plan risk-based remediation actions.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is the Easy Google Maps plugin?

Easy Google Maps is a WordPress plugin used to embed interactive maps into websites. It enables site administrators to display locations, routes, and custom markers to visitors. Because it functions by processing data on the server to render these visual elements, it requires access to web-facing request handlers.

What does PHP Object Injection mean in CVE-2026-73366?

This vulnerability, classified as CWE-502 (Deserialization of Untrusted Data), occurs when the plugin improperly handles serialized PHP objects. Because the plugin blindly trusts and processes this input, an attacker can supply a malicious object that the server then executes as code, potentially leading to a full system compromise.

How can an attacker trigger this vulnerability?

An attacker triggers this flaw by sending a specifically crafted HTTP request to a site running a vulnerable version of the plugin. No legitimate user interaction or prior authentication is required to initiate the attack. However, simply browsing the site or viewing a map normally will not trigger the vulnerability; it requires a request deliberately formatted to exploit the deserialization weakness.

Is my website at risk from this vulnerability?

According to Halo Surface Signal, this plugin is designed for public-facing content, meaning it is typically deployed on internet-accessible web servers. If your site uses this plugin and is reachable via the public internet, it is directly exposed to external requests that could trigger this flaw.

What should I do if I use Easy Google Maps?

Begin by auditing your environment to confirm where the Easy Google Maps plugin is installed and whether those instances are internet-facing. Once identified, consult with your application or platform teams to determine the business criticality of those specific sites and prepare to apply updates or implement access restrictions to mitigate the threat.

References

patchstack.com/database/wordpress/plugin/google-maps-easy/vulnerabil…

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.