WP Maps CVE-2026-66618

Requires an authenticated WordPress Administrator session (PR:H) reaching a vulnerable WP Maps admin parameter in versions ≤4.9.9; the injection is in an administrator-only code path, so a non-admin cannot trigger it. No user interaction and no non-default configuration are needed beyond having the plugin active. The dominant limiting factor is that the attacker must already hold the highest privilege level in WordPress, which sharply reduces added impact and rules out unauthenticated or low-privilege exploitation.

This is a high-CVSS (7.6) but comparatively low real-world-priority issue once the privilege requirement is weighed. The CVSS 3.1 vector CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:L is network-reachable and low-complexity with no user interaction, but PR:H means the attacker must already hold WordPress Administrator rights. In WordPress that is decisive: an Administrator can already install plugins, edit PHP, and run arbitrary code, so an SQL injection reachable only from an admin session grants little practical privilege escalation beyond what the role already permits - the vendor CWE label 'Administrator SQL Injection' confirms this. No EPSS score is provided, the CVE is not on CISA KEV, and no public exploit is identified in the input (Patchstack advisory reference only, not exploit code). Exploitation status: no public exploit identified at time of analysis. The vendor's S:C (scope change) and C:H are defensible for raw DB read, but the realistic threat is a malicious/compromised admin or a chained attacker who has already achieved admin, not opportunistic mass exploitation. Priority is low-to-moderate; treat as defense-in-depth hardening rather than an emergency.

An attacker who has already obtained WordPress Administrator credentials (via phishing, credential reuse, or a prior compromise) submits a crafted parameter to a WP Maps admin endpoint that is concatenated unsafely into a SQL query, letting them read arbitrary database contents such as other users' password hashes and secrets. No public exploit code is identified in the available data; exploitation is bounded by the requirement to already be authenticated as an administrator.