EUVD-2026-36943
GHSA-2fh6-qw9c-8c2g
Severity by source
AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L
Unauthenticated network SQLi over HTTP (AV:N/AC:L/PR:N/UI:N); plugin DB user typically allows writes so I:L (not N); scope-changed since plugin leaks whole-site DB.
Primary rating from Vendor (Patchstack).
CVSS VectorVendor: Patchstack
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L
Lifecycle Timeline
2DescriptionCVE.org
Unauthenticated SQL Injection in WP Maps <= 4.9.1 versions.
AnalysisAI
Unauthenticated SQL injection in the WP Maps WordPress plugin (versions 4.9.1 and earlier, by Flipper Code) allows remote attackers to inject arbitrary SQL queries against the underlying WordPress database without any authentication or user interaction. With a CVSS 3.1 score of 9.3 and a scope-changed vector, successful exploitation can disclose sensitive database contents (users, hashed credentials, secrets) and affect availability. No public exploit identified at time of analysis, but the unauthenticated nature and trivial complexity make weaponization likely once technical details circulate.
Technical ContextAI
WP Maps is a WordPress plugin developed by Flipper Code for embedding Google Maps content into WordPress sites. The root cause is CWE-89 (Improper Neutralization of Special Elements used in an SQL Command), meaning user-controlled input - likely a request parameter consumed by an AJAX action, shortcode handler, or REST endpoint registered by the plugin - is concatenated into a SQL query rather than being properly parameterized using $wpdb->prepare(). Because WordPress plugins typically execute queries with the privileges of the configured database user (commonly full read/write on the WordPress schema), an injection here grants the attacker the same level of access as the WordPress application itself. The CPE 'cpe:2.3:a:flipper_code_-_wordpress_development_company:wp_maps:*' covers all plugin versions up to and including 4.9.1.
RemediationAI
Upstream fix available per Patchstack advisory; released patched version not independently confirmed from the supplied data - administrators should upgrade WP Maps to the latest version above 4.9.1 published on the WordPress.org plugin repository and verify the fixed release number against the Patchstack advisory at https://patchstack.com/database/wordpress/plugin/wp-google-map-plugin/vulnerability/wordpress-wp-maps-plugin-4-9-1-sql-injection-vulnerability. Until the site is patched, deactivate and remove the WP Maps plugin (this will break any embedded maps but eliminates the attack surface entirely), or place a WAF rule (Patchstack, Wordfence, Cloudflare WordPress ruleset) in front of the site to block SQLi payloads targeting the plugin's AJAX/REST endpoints - note that WAF virtual patching is best-effort and can be bypassed with novel encodings. As secondary hardening, restrict the WordPress database user's privileges (revoke FILE, and any unneeded GRANT options) to limit post-exploitation impact, and rotate any secrets stored in wp_options if exploitation cannot be ruled out from logs.
Local file inclusion via path traversal in WP Maps WordPress plugin (before 4.9.7) allows any authenticated Subscriber-l
Local File Inclusion in the WP Maps WordPress plugin before 4.9.3 allows authenticated users to read arbitrary files by
Unvalidated input in the WP Google Map Plugin WordPress plugin, versions before 4.1.5, in the Manage Locations page with
Denial of Service in the WP Maps WordPress plugin before 4.9.7 allows any authenticated subscriber to exhaust server res
The WP Maps WordPress plugin before 4.7.2 does not sanitise and escape some of its Map settings, which could allow high
The WP Maps WordPress plugin before 4.7.2 does not sanitise and escape some of its Map settings, which could allow high
The WP Maps WordPress plugin before 4.7.2 does not sanitise and escape some of its Map settings, which could allow high
Cross-Site Request Forgery (CSRF) vulnerability in flippercode WordPress Plugin for Google Maps - WP MAPS (formerly WP G
Cross-Site Request Forgery (CSRF) vulnerability affecting Delete Marker Category, Delete Map, and Copy Map functions in
The WP Google Map WordPress plugin before 1.7.7 did not sanitise or escape the Map Title before outputting them in the p
Auth. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. No vendor pat
Sensitive data exposure in the WP Maps WordPress plugin (versions through 4.9.6) allows authenticated low-privilege user
Same weakness CWE-89 – SQL Injection
View allShare
External POC / Exploit Code
Leaving vuln.today