What is the CVSS score of CVE-2026-2580?

CVE-2026-2580 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.1%.

Which versions of WordPress are affected by CVE-2026-2580?

An unauthenticated SQL injection vulnerability in the WP Maps - Store Locator WordPress plugin (versions through 4.9.1) allows attackers to extract sensitive database information without any user…

How to fix or mitigate CVE-2026-2580?

Within 24 hours: Identify all WordPress instances running WP Maps – Store Locator plugin and document affected versions; disable or deactivate the plugin immediately as a temporary measure. Within 7 days: Implement Web Application Firewall (WAF) rules to block SQL injection patterns in the 'orderby' parameter; scan database logs for signs of exploitation. Within 30 days: Monitor vendor for patch release and apply immediately upon availability; conduct security audit of all database access logs for potential data exfiltration.

WordPress CVE-2026-2580

EUVD-2026-14335 HIGH

SQL Injection (CWE-89)

2026-03-22 Wordfence

GHSA-q2xw-gm54-j9h5

WordPress SQLi Google

7.5

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Re-analysis Queued

Apr 24, 2026 - 16:37 vuln.today

cvss_changed

EUVD ID Assigned

Mar 22, 2026 - 23:30 euvd

EUVD-2026-14335

Analysis Generated

Mar 22, 2026 - 23:30 vuln.today

CVE Published

Mar 22, 2026 - 23:24 nvd

HIGH 7.5

DescriptionCVE.org

The WP Maps - Store Locator,Google Maps,OpenStreetMap,Mapbox,Listing,Directory & Filters plugin for WordPress is vulnerable to time-based SQL Injection via the ‘orderby’ parameter in all versions up to, and including, 4.9.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.

AnalysisAI

A time-based SQL injection vulnerability exists in the WP Maps - Store Locator plugin for WordPress through version 4.9.1, allowing unauthenticated attackers to extract sensitive database information via the insufficiently sanitized 'orderby' parameter. With a CVSS score of 7.5 (High), this vulnerability requires no privileges or user interaction and can be exploited remotely over the network. No KEV listing or EPSS data is provided, but the vulnerability has been publicly disclosed by Wordfence with technical details and code references available.

Technical ContextAI

This vulnerability affects the WP Google Map Plugin (identified by CPE cpe:2.3:a:flippercode:wp_maps_–_store_locator,google_maps,openstreetmap,mapbox,listing,directory_&_filters) and is classified as CWE-89 (SQL Injection). The root cause lies in the class.tabular.php file at line 780 and wpgmp-helper.php at line 127, where the 'orderby' parameter is incorporated into SQL queries without proper escaping or prepared statement usage. Time-based SQL injection allows attackers to infer database contents by measuring response times when injecting conditional SQL statements that include time delays, making it possible to extract data byte-by-byte even when direct query results are not returned to the user.

RemediationAI

Site administrators should immediately update the WP Maps plugin to a version newer than 4.9.1 that addresses this SQL injection vulnerability (check the WordPress plugin repository or Wordfence advisory at https://www.wordfence.com/threat-intel/vulnerabilities/id/8d954868-eff2-497d-84e7-cc42da8a4c6f?source=cve for the patched release). If immediate patching is not possible, implement web application firewall (WAF) rules to block requests containing SQL injection patterns in the 'orderby' parameter, restrict administrative access to trusted IP addresses, enable WordPress security logging to detect exploitation attempts, and consider temporarily disabling the plugin if it is not critical to operations. Review database logs for suspicious queries and conduct a security audit to determine if unauthorized data access has occurred.