Wp Maps Store Locator Google Maps Openstreetmap Mapbox Listing Directory Filters CVE-2026-2580

Requires WP Maps plugin versions up to 4.9.1 installed and activated on WordPress. Unauthenticated remote attacker can exploit via 'orderby' parameter without victim interaction. No special WordPress configuration required; affects default installations.

The CVSS vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) indicates this is a remotely exploitable vulnerability with low attack complexity requiring no authentication or user interaction, making it highly accessible to attackers. The high confidentiality impact means sensitive database information including user credentials, API keys, and customer data can be extracted. Despite the high CVSS score, the risk is somewhat tempered by the time-based nature of the attack which makes large-scale data exfiltration slower compared to error-based SQL injection. However, the unauthenticated attack vector and availability of source code references at plugins.trac.wordpress.org significantly lower the barrier for exploitation, making this a genuine priority for organizations using this plugin, particularly those storing sensitive location or customer data.

An unauthenticated attacker sends specially crafted HTTP requests to a WordPress site running the vulnerable plugin, injecting time-based SQL payloads into the 'orderby' parameter such as 'column1; IF(1=1, SLEEP(5), 0)'. By measuring response times, the attacker systematically extracts database contents including administrator credentials, user email addresses, and potentially API keys or customer information stored in custom tables. The publicly available source code at plugins.trac.wordpress.org provides attackers with exact implementation details to craft effective exploits, making this vulnerability readily exploitable without sophisticated reverse engineering.