Maps Marker Pro EUVD-2026-62378

Exploitation requires only that a WordPress site has the Maps Marker Pro plugin (version <= 4.32) installed and active, with the vulnerable request handler reachable over the network - the CVSS vector AV:N/AC:L/PR:N/UI:N confirms no authentication, no user interaction, and low complexity, i.e. exploitable against default configurations. The primary limiting factor is simply plugin presence and version: sites on a patched build, sites not running Maps Marker Pro, or deployments that block the affected endpoint via WAF/network controls are not exploitable. No special plugin feature toggle or non-default setting was cited in the advisory as a precondition.

The supplied CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L, base 9.3) describes a network-reachable, low-complexity, unauthenticated attack with high confidentiality impact and a changed scope - consistent with blind/unauthenticated SQLi that reads data beyond the plugin's own boundary. No EPSS score, SSVC decision, or POC signal was provided in the input, and the CVE is not in CISA KEV, so exploitation status is 'no public exploit identified at time of analysis' rather than active exploitation. The combination of unauthenticated access plus SQLi against a public-facing CMS makes this a genuine priority for exposed sites even though widespread automated exploitation is not yet evidenced; the scoring is internally consistent, with the only notable oddity being I:N/A:L (read-oriented injection) rather than the full C:H/I:H often seen for SQLi. Missing data: EPSS, POC availability, and the exact fixed version are not present in the provided intelligence and should be confirmed against the Patchstack advisory.

An anonymous attacker sends a crafted HTTP request to the vulnerable Maps Marker Pro endpoint with a malicious value in the injectable parameter, manipulating the underlying SQL query to extract WordPress user records, password hashes, and secret keys from the database. Because no authentication or user interaction is required (PR:N/UI:N) and complexity is low (AC:L), the request can be scripted and mass-scanned against exposed WordPress sites; no public exploit code has been identified yet, so the current scenario relies on attacker-developed tooling.