CVE-2025-67535

The Maps WordPress plugin contains a vulnerability that allows attackers with administrator-level access and above to inject malicious PHP objects through untrusted input deserialization in versions up to 4.8.6. This flaw does not rely on an existing POP chain within the affected software itself but can be exploited further if another plugin or theme is present, potentially enabling file deletion, data retrieval, or code execution.

Based on public CVE data (MITRE/NVD).