EUVD-2026-36943
GHSA-2fh6-qw9c-8c2g
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessFingerprint WordPress site running WP Maps ≤4.9.1
-
DeliverySend crafted HTTP request with SQLi payload to vulnerable plugin endpoint
-
ExploitExfiltrate wp_users hashes and secrets via UNION or blind injection
-
ExecutionCrack admin password offline
-
PersistAuthenticate to wp-admin and upload malicious plugin
-
ImpactAchieve full site compromise
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization Parameterized queries, prepared statements
MITRE ATT&CK
2 techniques across 2 tactics: Initial Access, Persistence The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | No special conditions - remote unauthenticated exploitation against any default WordPress installation that has the WP Maps plugin (versions ≤ 4.9.1) installed and activated, reachable over HTTP/HTTPS. The CVSS vector AV:N/AC:L/PR:N/UI:N confirms no authentication, no user interaction, and no non-default configuration is required. The only limiting factor is that the target must actually run a vulnerable WP Maps version; sites without the plugin, or already upgraded past 4.9.1, are not exposed. The specific vulnerable parameter/endpoint is not disclosed in the public advisory, which marginally raises the bar for opportunistic attackers until the Patchstack details or a POC are released. |
| Impact | Real-world risk is high. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L) confirms remote, unauthenticated, low-complexity exploitation with no user interaction - the easiest possible attack profile. Scope:Changed combined with Confidentiality:High indicates the vulnerable plugin can leak data beyond its own security authority (i.e., the entire WordPress database, including other plugins' data and possibly hashed admin credentials). The vector lists Integrity:None, which is unusual for SQLi - most SQL injections allow at least UPDATE/INSERT - so defenders should treat I:N as a lower bound and verify against the plugin code, since blind SQLi or stacked queries could enable writes. EPSS, KEV status, POC availability, and SSVC data are not provided in the input, so exploitation probability cannot be quantified; however, WordPress plugin SQLi disclosed by Patchstack historically attracts mass scanning within days. No public exploit identified at time of analysis, but the conditions are ideal for automation. |
| Exploit ScenarioDerived | An attacker sends a single crafted HTTP request to a public-facing WordPress site running WP Maps ≤ 4.9.1, injecting a UNION SELECT or time-based payload into a vulnerable plugin parameter to extract wp_users password hashes and authentication keys from wp_options. The attacker then cracks the administrator hash offline (or replays session cookies) to log in as admin, upload a malicious plugin, and achieve full site takeover. The attack is fully automatable and requires no authentication, no user interaction, and minimal reconnaissance beyond fingerprinting the plugin's presence. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jun 15, 2026
Unauthenticated SQL injection in the WP Maps WordPress plugin (versions 4.9.1 and earlier, by Flipper Code) allows remote attackers to inject arbitrary SQL queries against the underlying WordPress database without any authentication or user interaction. With a CVSS 3.1 score of 9.3 and a scope-changed vector, successful exploitation can disclose sensitive database contents (users, hashed credentials, secrets) and affect availability. No public exploit identified at time of analysis, but the unauthenticated nature and trivial complexity make weaponization likely once technical details circulate.
RemediationAI
Upstream fix available per Patchstack advisory; released patched version not independently confirmed from the supplied data - administrators should upgrade WP Maps to the latest version above 4.9.1 published on the WordPress.org plugin repository and verify the fixed release number against the Patchstack advisory at https://patchstack.com/database/wordpress/plugin/wp-google-map-plugin/vulnerability/wordpress-wp-maps-plugin-4-9-1-sql-injection-vulnerability. Until the site is patched, deactivate and remove the WP Maps plugin (this will break any embedded maps but eliminates the attack surface entirely), or place a WAF rule (Patchstack, Wordfence, Cloudflare WordPress ruleset) in front of the site to block SQLi payloads targeting the plugin's AJAX/REST endpoints - note that WAF virtual patching is best-effort and can be bypassed with novel encodings. As secondary hardening, restrict the WordPress database user's privileges (revoke FILE, and any unneeded GRANT options) to limit post-exploitation impact, and rotate any secrets stored in wp_options if exploitation cannot be ruled out from logs.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
WP Maps is a WordPress plugin developed by Flipper Code for embedding Google Maps content into WordPress sites. The root cause is CWE-89 (Improper Neutralization of Special Elements used in an SQL Command), meaning user-controlled input - likely a request parameter consumed by an AJAX action, shortcode handler, or REST endpoint registered by the plugin - is concatenated into a SQL query rather than being properly parameterized using $wpdb->prepare(). Because WordPress plugins typically execute queries with the privileges of the configured database user (commonly full read/write on the WordPress schema), an injection here grants the attacker the same level of access as the WordPress application itself. The CPE 'cpe:2.3:a:flipper_code_-_wordpress_development_company:wp_maps:*' covers all plugin versions up to and including 4.9.1.
Know when Wp Maps gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L
Unauthenticated network SQLi over HTTP (AV:N/AC:L/PR:N/UI:N); plugin DB user typically allows writes so I:L (not N); scope-changed since plugin leaks whole-site DB.
Primary rating from Vendor (Patchstack).
CVSS VectorVendor: Patchstack
DescriptionCVE.org
Unauthenticated SQL Injection in WP Maps <= 4.9.1 versions.
Executive ViewAI
The WP Maps WordPress plugin (versions 4.9.1 and earlier) contains a critical unauthenticated SQL injection vulnerability enabling direct unauthorized database access. No public exploit identified at time of analysis, but the vulnerability's combination of unauthenticated access and trivial exploitation complexity creates immediate organizational risk of sensitive data compromise. No vendor-released patch identified at time of analysis, requiring urgent mitigation through complete plugin removal and immediate alternative solution deployment.
Disable and remove WP Maps plugin entirely from all WordPress installations; deploy Web Application Firewall rules to detect and block SQL injection patterns; restrict database user accounts to least-privilege permissions and specific required databases; enable comprehensive SQL query logging with real-time anomaly detection and alerting; consider network-level isolation of affected systems until alternative solution deployed.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
SQL injection exploits the way applications construct database queries by mixing user input directly into SQL statements.
Local file inclusion via path traversal in WP Maps WordPress plugin (before 4.9.7) allows any authenticated Subscriber-l
Local File Inclusion in the WP Maps WordPress plugin before 4.9.3 allows authenticated users to read arbitrary files by
Unvalidated input in the WP Google Map Plugin WordPress plugin, versions before 4.1.5, in the Manage Locations page with
Denial of Service in the WP Maps WordPress plugin before 4.9.7 allows any authenticated subscriber to exhaust server res
The WP Maps WordPress plugin before 4.7.2 does not sanitise and escape some of its Map settings, which could allow high
The WP Maps WordPress plugin before 4.7.2 does not sanitise and escape some of its Map settings, which could allow high
The WP Maps WordPress plugin before 4.7.2 does not sanitise and escape some of its Map settings, which could allow high
Cross-Site Request Forgery (CSRF) vulnerability in flippercode WordPress Plugin for Google Maps - WP MAPS (formerly WP G
Cross-Site Request Forgery (CSRF) vulnerability affecting Delete Marker Category, Delete Map, and Copy Map functions in
The WP Google Map WordPress plugin before 1.7.7 did not sanitise or escape the Map Title before outputting them in the p
SQL injection in the WP Maps WordPress plugin (Flipper Code) through version 4.9.9 lets an attacker who already holds a
Auth. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. No vendor pat
Exploit-DB