WP Go Maps CVE-2026-15381

Exploitation requires the WP Go Maps plugin (version before 10.1.04) to be installed and activated on a WordPress site, with the vulnerable parameter reachable via unauthenticated HTTP requests - no login session or user account is required per the CVSS PR:N rating. The high attack complexity (AC:H) and SSVC non-automatable classification indicate that exploitation cannot be trivially scripted across large numbers of targets simultaneously, and likely requires careful payload crafting or specific timing to succeed. Impact is strictly read-only against the vulnerable system's database (C:L, I:N, A:N), so attackers cannot modify or delete data through this vector alone. Exploitation is limited to WordPress environments running this specific plugin; sites not using WP Go Maps are entirely unaffected.

CVSS scores this at 3.7 (Low), driven primarily by AC:H (high attack complexity) and a confidentiality-only, low-severity impact (C:L/I:N/A:N) scoped to the vulnerable system (S:U). Despite the unauthenticated network vector (AV:N/PR:N/UI:N), the high complexity rating and SSVC's 'non-automatable' classification together indicate the attack cannot be trivially scripted at scale - suggesting a blind injection class or specific payload-tuning requirement. EPSS at 0.18% (7th percentile) corroborates low observed exploitation probability. A public POC is documented by WPScan, which is a meaningful escalation signal relative to an unexploited flaw, but this must not be conflated with confirmed active exploitation - no KEV listing exists. The practical risk is highest for WordPress deployments holding sensitive relational data (PII, e-commerce records, credentials) in the same database, and lower for purely informational sites. Overall, this is a real but non-critical priority: patch promptly in sensitive environments, and treat it as lower urgency for low-value-data deployments.

An unauthenticated attacker identifies a WordPress site running WP Go Maps prior to 10.1.04 and submits a crafted HTTP request - likely a GET or POST to a plugin-handled endpoint - injecting SQL syntax into the vulnerable parameter. After overcoming the high-complexity exploitation requirement (such as constructing a valid blind injection payload), the attacker iterates through database contents to extract WordPress user table records, including hashed passwords and email addresses. A public proof-of-concept documented by WPScan reduces the skill barrier for this attack.