What is the CVSS score of CVE-2026-65450?

CVE-2026-65450 has a CVSS 3.1 base score of 8.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:L. EPSS exploitation probability: 0.3%.

Which versions of MapSVG are affected by CVE-2026-65450?

MapSVG WordPress plugin versions 8.14.0 and earlier contain a SQL injection vulnerability exploitable by contributor-level users-a role commonly granted on multi-author sites-enabling direct database…

How to fix or mitigate CVE-2026-65450?

Within 24 hours, audit your WordPress deployment to identify instances of MapSVG plugin and immediately disable all versions 8.14.0 and earlier. Simultaneously, restrict Contributor-level role permissions to trusted users only and review recent database access logs for suspicious activity. Over the next 7 days, monitor the plugin vendor's official channels and WordPress security advisories for patch releases, establish forensic logging if you haven't already, and prepare an incident response plan for potential exploitation. Within 30 days of a patch becoming available, deploy the updated MapSVG version across all WordPress instances, conduct a full database audit to identify any unauthorized access during the vulnerable period, and verify that database credentials have not been compromised.

MapSVG CVE-2026-65450

EUVD-2026-48215 HIGH

SQL Injection (CWE-89)

2026-07-23 Patchstack

GHSA-575v-f768-wg2w

WordPress SQLi Wordpress Plugin Mapsvg Romancode

8.5

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

8.5 HIGH

AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:L

vuln.today AI

7.1 HIGH

Remote low-complexity SQLi needing a Contributor account gives AV:N/AC:L/PR:L; primarily data disclosure (C:H) with limited write potential (I:L); I treat impact as in-database, so S:U rather than the vendor's S:C.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

None

Availability

Low

Lifecycle Timeline

Analysis Generated

Jul 23, 2026 - 12:38 vuln.today

CVE Published

Jul 23, 2026 - 11:18 cve.org

HIGH 8.5

DescriptionCVE.org

Contributor SQL Injection in MapSVG <= 8.14.0 versions.

AnalysisAI

SQL injection in the MapSVG WordPress plugin (versions 8.14.0 and earlier) allows Contributor-level authenticated users to inject arbitrary SQL through an unsanitized parameter (CWE-89), exposing the WordPress database. Because Contributor is a low-privilege role that many blogs and multi-author sites grant liberally, an attacker with such an account can read sensitive data including user credentials and secret keys. There is no public exploit identified at time of analysis and the issue is not listed in CISA KEV, but SQLi in WordPress plugins is a well-understood, easily weaponized class once details are public.

Technical ContextAI

MapSVG (vendor CPE cpe:2.3:a:romancode:mapsvg) is a WordPress plugin - distributed in both a free 'MapSVG Lite' edition and a premium edition - that renders interactive vector and geo maps and stores map/region data in the WordPress MySQL database. The flaw is CWE-89 (Improper Neutralization of Special Elements used in an SQL Command): a request parameter reachable by Contributor-level users is concatenated into a database query without proper parameterization or use of $wpdb->prepare(), allowing the attacker to alter the query structure. Because WordPress runs all plugins against a single shared database, a successful injection can reach any table (wp_users, wp_options, etc.), not just the plugin's own map data.

RemediationAI

No vendor-released patch version was identified in the available data, so confirm the fixed release directly against the Patchstack advisory (https://patchstack.com/database/wordpress/plugin/mapsvg-lite-interactive-vector-maps/vulnerability/wordpress-mapsvg-plugin-8-14-0-sql-injection-vulnerability) and the WordPress.org plugin changelog, then upgrade to the first release above 8.14.0 as soon as it is published. Until a patched version is confirmed and applied, reduce exposure by removing or downgrading untrusted Contributor and Author accounts so only fully trusted users hold post-creation privileges, and audit existing accounts for unexpected registrations - the trade-off is reduced multi-author workflow. As a stronger compensating control, deploy a WordPress WAF (Patchstack, Wordfence, or equivalent) with a virtual patch/rule blocking SQL metacharacters on the vulnerable plugin endpoint, accepting possible false positives on legitimate map data; if the plugin is not essential, deactivate and remove it entirely, which fully eliminates the risk at the cost of losing map functionality.