What is the CVSS score of CVE-2026-3222?

CVE-2026-3222 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.2%.

Which versions of WordPress are affected by CVE-2026-3222?

The WP Maps WordPress plugin contains a critical SQL injection vulnerability affecting all versions through 4.9.1 that could allow attackers to extract sensitive database information.

How to fix or mitigate CVE-2026-3222?

Within 24 hours: Audit all WordPress installations to identify WP Maps plugin usage and version numbers; disable the plugin on all affected systems if business function permits. Within 7 days: Implement WAF rules to block malicious requests to the vulnerable 'location_id' parameter; apply input validation rules and rate limiting. Within 30 days: Either migrate to an alternative location mapping solution, upgrade to a patched version when available, or maintain continuous monitoring with WAF protections as a permanent control.

WordPress CVE-2026-3222

HIGH

SQL Injection (CWE-89)

2026-03-11 security@wordfence.com

WordPress SQLi

7.5

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Re-analysis Queued

Apr 22, 2026 - 21:37 vuln.today

cvss_changed

Analysis Generated

Mar 12, 2026 - 22:06 vuln.today

CVE Published

Mar 11, 2026 - 06:17 nvd

HIGH 7.5

DescriptionCVE.org

The WP Maps plugin for WordPress is vulnerable to time-based blind SQL Injection via the 'location_id' parameter in all versions up to, and including, 4.9.1. This is due to the plugin's database abstraction layer (FlipperCode_Model_Base::is_column()) treating user input wrapped in backticks as column names, bypassing the esc_sql() escaping function. Additionally, the wpgmp_ajax_call AJAX handler (registered for unauthenticated users via wp_ajax_nopriv) allows calling arbitrary class methods including wpgmp_return_final_capability, which passes the unsanitized location_id GET parameter directly to a database query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.

AnalysisAI

Unauthenticated attackers can exploit a time-based blind SQL injection in the WP Maps plugin for WordPress (versions up to 4.9.1) through the location_id parameter in the wpgmp_ajax_call AJAX handler to extract sensitive database information. The vulnerability stems from improper input validation that allows backtick-wrapped user input to bypass SQL escaping functions. No patch is currently available, leaving all affected WordPress installations at risk of data disclosure.

Technical ContextAI

Classified as CWE-89 (SQL Injection). Affects WP Maps (WordPress plugin). The WP Maps plugin for WordPress is vulnerable to time-based blind SQL Injection via the 'location_id' parameter in all versions up to, and including, 4.9.1. This is due to the plugin's database abstraction layer (FlipperCode_Model_Base::is_column()) treating user input wrapped in backticks as column names, bypassing the esc_sql() escaping function. Additionally, the wpgmp_ajax_call AJAX handler (registered for unauthenticated users via wp_ajax_nopriv) allows calling arbitrary class meth

Affected ProductsAI

Vendor: WordPress. Product: WP Maps (WordPress plugin).

RemediationAI

Monitor vendor advisories for a patch. Use parameterized queries. Implement input validation. Restrict network access to the affected service where possible.