Is CVE-2020-37242 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2020-37242 being exploited in the wild.

How severe is CVE-2020-37242?

High severity, with a CVSS score of 8.2, published 16 May 2026.

Which products and versions are affected?

Supsystic Ultimate Maps <= 1.1.12.

Is there a fix for CVE-2020-37242?

A patch was published on 2020-12-09: Vulnerability fixed following contact with WordPress Plugin Security team Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2020-37242 attacked?

It is attacked over the network, in a network appliance.

Am I affected by CVE-2020-37242?

Check whether you run Supsystic Ultimate Maps at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2020-37242: Supsystic Ultimate Maps SQL injection in sidx parameter

Q: Is there a fix for CVE-2020-37242?

A patch was published on 2020-12-09: Vulnerability fixed following contact with WordPress Plugin Security team Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2020-37242 attacked?

It is attacked over the network, in a network appliance.

Q: Am I affected by CVE-2020-37242?

Check whether you run Supsystic Ultimate Maps at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2020-37242 · Severity: high · CVSS 8.2 · Published 2026-05-16

Supsystic Ultimate Maps, a WordPress plugin used to create interactive maps, contains a security flaw that allows unauthorized individuals to access the website's database. By sending specially crafted web requests, an attacker can bypass security controls to steal sensitive information, such as user credentials or site configuration data. This could lead to a full compromise of the website or the exposure of private customer information.

Technologies: Supsystic Ultimate Maps. Vendors: Supsystic.

Quick answers

Is CVE-2020-37242 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2020-37242 being exploited in the wild.
How severe is CVE-2020-37242?: High severity, with a CVSS score of 8.2, published 16 May 2026.
Which products and versions are affected?: Supsystic Ultimate Maps <= 1.1.12.
Is there a fix for CVE-2020-37242?: A patch was published on 2020-12-09: Vulnerability fixed following contact with WordPress Plugin Security team Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2020-37242 attacked?: It is attacked over the network, in a network appliance.
Am I affected by CVE-2020-37242?: Check whether you run Supsystic Ultimate Maps at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

An SQL injection vulnerability exists in the Supsystic Ultimate Maps plugin for WordPress (version 1.1.12 and earlier) due to improper sanitization of the 'sidx' GET parameter within the 'getListForTbl' action. This flaw allows unauthenticated remote attackers to perform boolean-based blind or time-based blind SQL injection attacks. By exploiting this vulnerability, an attacker can execute arbitrary SQL queries to extract sensitive information from the WordPress database. The issue was reportedly fixed around December 9, 2020, following coordination with the WordPress Plugin Security team.

Affected products

Supsystic Ultimate Maps <= 1.1.12

Timeline

2020-07-24: disclosed: Vulnerability discovered and vendor notified by Erik David Martin
2020-12-09: patched: Vulnerability fixed following contact with WordPress Plugin Security team
2021-02-08: other: Exploit code published on Exploit-DB
2026-05-16: advisory: CVE-2020-37242 published in NVD

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.