What is the CVSS score of CVE-2026-59526?

CVE-2026-59526 has a CVSS 3.1 base score of 9.3 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L. EPSS exploitation probability: 0.2%.

Which versions of MapSVG are affected by CVE-2026-59526?

The MapSVG WordPress plugin (versions 8.14.0 and earlier) contains a critical SQL injection vulnerability that allows direct, unauthenticated database access from the internet.

How to fix or mitigate CVE-2026-59526?

Within 24 hours: Conduct a complete inventory of MapSVG installations across all WordPress instances using wp plugin list command; immediately disable or deactivate the plugin if not mission-critical to operations. Within 7 days: Implement interim technical controls including WAF rules to block SQL injection patterns in WordPress request handlers, enforce database read-only access where feasible, and configure enhanced query logging and monitoring; subscribe to Patchstack and vendor security alerts for patch availability updates. Within 30 days: Execute permanent remediation by either updating MapSVG to a patched version upon release or migrating to alternative mapping solutions; validate database access controls and monitoring remain in place during transition.

MapSVG CVE-2026-59526

EUVD-2026-48192 CRITICAL

SQL Injection (CWE-89)

2026-07-23 Patchstack

GHSA-86rr-g9vq-pqqg

WordPress SQLi Wordpress Plugin Mapsvg Romancode

9.3

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

9.3 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L

vuln.today AI

8.2 HIGH

Remote unauthenticated low-complexity injection (AV:N/AC:L/PR:N/UI:N); SQLi grants full DB read (C:H) and potential limited writes (I:L) within the same DB authority, so S:U rather than S:C.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

None

Availability

Low

Lifecycle Timeline

Analysis Generated

Jul 23, 2026 - 12:47 vuln.today

CVE Published

Jul 23, 2026 - 11:18 cve.org

CRITICAL 9.3

DescriptionCVE.org

Unauthenticated SQL Injection in MapSVG <= 8.14.0 versions.

AnalysisAI

SQL injection in the MapSVG WordPress plugin (versions 8.14.0 and earlier) lets remote unauthenticated attackers inject arbitrary SQL through the plugin's request handling, exposing the WordPress database. Reported by Patchstack and rated CVSS 9.3, the flaw requires no authentication or user interaction, though no public exploit has been identified at time of analysis. Any WordPress site running a vulnerable MapSVG build is directly exposed to database extraction over the network.

Technical ContextAI

MapSVG is a commercial WordPress plugin (vendor CPE cpe:2.3:a:romancode:mapsvg) that renders interactive SVG/geo maps and typically backs them with its own database tables for regions, markers, and datasets. The root cause is CWE-89 (Improper Neutralization of Special Elements used in an SQL Command): user-controllable input reaches a SQL query without proper parameterization or sanitization, allowing an attacker to alter query structure. Because the plugin exposes map/data endpoints that are reachable pre-authentication in WordPress, the injectable parameter can be driven by any unauthenticated visitor, letting crafted input manipulate queries against the shared WordPress MySQL/MariaDB backend.

RemediationAI

Update MapSVG to the vendor-released fixed version above 8.14.0 as the primary remediation; a specific patched version number was not included in the provided data, so confirm the exact fixed release directly from the vendor or the Patchstack advisory (https://patchstack.com/database/wordpress/plugin/mapsvg/vulnerability/wordpress-mapsvg-plugin-8-14-0-sql-injection-vulnerability-3) before deploying - no vendor-released fix version is independently confirmed at time of analysis. If an immediate update is not possible, place a WAF or virtual patch (Patchstack, Wordfence, or ModSecurity rules) in front of the site to filter SQL metacharacters on MapSVG endpoints, or deactivate the MapSVG plugin entirely to remove the attack surface (side effect: any maps rendered by the plugin will stop working). As a defense-in-depth step, ensure the WordPress database user holds least privilege and rotate credentials/secrets if you suspect the flaw was exploited, since database read access could have exposed password hashes and keys.