EUVD-2026-62378
GHSA-vx6x-cp3c-h55h
Severity by source
AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L
Unauthenticated network SQLi (AV:N/AC:L/PR:N/UI:N) yields high confidentiality via data extraction (C:H) and limited integrity from possible query manipulation (I:L); scope kept Unchanged as impact stays within the DB the app manages.
Primary rating from Vendor (Patchstack).
CVSS VectorVendor: Patchstack
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L
Lifecycle Timeline
2DescriptionCVE.org
Unauthenticated SQL Injection in Maps Marker Pro <= 4.32 versions.
AnalysisAI
Unauthenticated SQL injection in the Maps Marker Pro WordPress plugin (all versions up to and including 4.32) lets remote attackers inject arbitrary SQL against the site database without any credentials or user interaction. Reported by Patchstack and rated CVSS 9.3, the flaw exposes the backing WordPress database to unauthenticated extraction. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires only that a WordPress site has the Maps Marker Pro plugin (version <= 4.32) installed and active, with the vulnerable request handler reachable over the network - the CVSS vector AV:N/AC:L/PR:N/UI:N confirms no authentication, no user interaction, and low complexity, i.e. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The supplied CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L, base 9.3) describes a network-reachable, low-complexity, unauthenticated attack with high confidentiality impact and a changed scope - consistent with blind/unauthenticated SQLi that reads data beyond the plugin's own boundary. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An anonymous attacker sends a crafted HTTP request to the vulnerable Maps Marker Pro endpoint with a malicious value in the injectable parameter, manipulating the underlying SQL query to extract WordPress user records, password hashes, and secret keys from the database. Because no authentication or user interaction is required (PR:N/UI:N) and complexity is low (AC:L), the request can be scripted and mass-scanned against exposed WordPress sites; no public exploit code has been identified yet, so the current scenario relies on attacker-developed tooling. |
| Remediation | Upgrade Maps Marker Pro to a release newer than 4.32 that contains the vendor fix; the input data does not include an exact patched version number, so confirm the fixed release directly on the Patchstack advisory (https://patchstack.com/database/wordpress/plugin/maps-marker-pro/vulnerability/wordpress-maps-marker-pro-plugin-4-32-sql-injection-vulnerability) and the vendor changelog before deploying - do not assume a version. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours: disable Maps Marker Pro plugin across all WordPress installations and audit server logs for SQL injection attack attempts. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-89 – SQL Injection
View allShare
External POC / Exploit Code
Leaving vuln.today