MapSVG EUVD-2026-102859

Exploitation requires an authenticated session on the target WordPress site: the CVSS vector specifies PR:L, so the attacker needs a valid low-privileged account (e.g., subscriber, contributor, or customer role) on a site running the MapSVG (mapsvg-lite-interactive-vector-maps) plugin at version 8.16.1 or earlier. No user interaction is required (UI:N) and the attack is remote over the network (AV:N/AC:L). The limiting factors are the authentication requirement and the need for the site to both run the affected plugin version and expose the vulnerable endpoint to the attacker's role; sites that do not provision untrusted low-privilege accounts face substantially reduced real-world exposure.

The input CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:L, base 8.5 High) describes a network-reachable, low-complexity SQL injection requiring some level of authentication (PR:L). No EPSS score was supplied, and there is no CISA KEV listing and no proof-of-concept flagged in the intelligence, so exploitation status is 'no public exploit identified at time of analysis.' The signals are therefore moderately but not uniformly alarming: the CVSS is High and the attack vector is remote with low complexity, but the PR:L requirement means an attacker must first hold a valid (even low-privileged) WordPress account, which meaningfully narrows the opportunistic attack surface versus a truly unauthenticated flaw. One signal worth scrutiny: the input marks Scope Changed (S:C) with C:H/I:N/A:L, which is an unusual profile for a classic plugin SQL injection - SQLi typically yields confidentiality impact and often integrity impact within the same security scope, so the S:C and the I:N (no integrity impact) combination should be verified against the Patchstack advisory. Without EPSS or KEV data, this reads as a credible, patch-worthy High-severity issue for affected WordPress sites rather than a confirmed mass-exploitation emergency; prioritize patching where low-trust accounts (subscribers/contributors/customers) are provisioned.

An attacker who holds a low-privileged account on a WordPress site running MapSVG (<= 8.16.1) sends a crafted request to a plugin endpoint whose parameter is concatenated into an SQL query, injecting SQL to read arbitrary database contents such as user records and password hashes. No proof-of-concept is identified in the provided data, but the AV:N/AC:L profile means the request is remote and reliably repeatable once a valid session is obtained.