EUVD-2026-51428
GHSA-55gh-xjv7-5vwp
Severity by source
AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N
Unauthenticated network access (AV:N/PR:N); AC:H consistent with SSVC non-automatable and blind injection complexity; read-only database impact only (C:L/I:N/A:N), no scope change.
Primary rating from Vendor (WPScan).
CVSS VectorVendor: WPScan
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N
Lifecycle Timeline
5DescriptionCVE.org
The WP Go Maps WordPress plugin before 10.1.04 does not properly sanitise and escape a parameter before using it in a SQL query, allowing unauthenticated users to perform SQL injection attacks.
AnalysisAI
SQL injection in WP Go Maps WordPress plugin (all versions before 10.1.04) allows unauthenticated network attackers to read data from the underlying WordPress database by injecting malicious SQL syntax into an unsanitized plugin parameter. Reported by WPScan, a publicly available proof-of-concept exploit exists for this flaw; however, CISA KEV does not list active exploitation, and EPSS at 0.18% (7th percentile) indicates low observed exploitation probability in the wild. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires the WP Go Maps plugin (version before 10.1.04) to be installed and activated on a WordPress site, with the vulnerable parameter reachable via unauthenticated HTTP requests - no login session or user account is required per the CVSS PR:N rating. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | CVSS scores this at 3.7 (Low), driven primarily by AC:H (high attack complexity) and a confidentiality-only, low-severity impact (C:L/I:N/A:N) scoped to the vulnerable system (S:U). … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An unauthenticated attacker identifies a WordPress site running WP Go Maps prior to 10.1.04 and submits a crafted HTTP request - likely a GET or POST to a plugin-handled endpoint - injecting SQL syntax into the vulnerable parameter. After overcoming the high-complexity exploitation requirement (such as constructing a valid blind injection payload), the attacker iterates through database contents to extract WordPress user table records, including hashed passwords and email addresses. … |
| Remediation | Upgrade WP Go Maps to version 10.1.04 or later, which contains the vendor-released patch addressing this SQL injection. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Wp Go Maps
View allThe WP Go Maps (formerly WP Google Maps) plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ma
In the wp-google-maps plugin before 7.11.18 for WordPress, includes/class.rest-api.php in the REST API does not sanitize
The WP Go Maps (formerly WP Google Maps) WordPress plugin before 9.0.28 does not properly protect most of its REST API r
The wp-google-maps plugin before 7.10.43 for WordPress has XSS via the wp-admin/admin.php PATH_INFO. Rated medium severi
The WP Google Maps WordPress plugin before 8.1.12 did not sanitise, validate of escape the Map Name when output in the M
The WP Google Maps plugin before 7.11.35 for WordPress allows XSS via the wp-admin/ rectangle_name or rectangle_opacity
WP Go Maps WordPress plugin before 10.0.10 exposes unapproved marker records - including PII in address and description
Unauthenticated information disclosure in WP Go Maps WordPress plugin before 10.0.10 allows any visitor to retrieve map
Multiple cross-site scripting (XSS) vulnerabilities in the WP Google Maps plugin before 6.0.27 for WordPress allow remot
The WP Go Maps (formerly WP Google Maps) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Custom JS
The WP Go Maps (formerly WP Google Maps) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugi
The WP Go Maps (formerly WP Google Maps) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugi
Same weakness CWE-89 – SQL Injection
View allShare
External POC / Exploit Code
Leaving vuln.today