Executive brief
WP Go Maps is a popular WordPress plugin used to add interactive maps to websites. A security flaw in the plugin allows unauthorized individuals to manipulate database queries by sending specially crafted requests to the map's data interface. This could allow an attacker to access sensitive information from the website's database without needing a username or password.
Technical details
A SQL injection vulnerability exists in the WP Go Maps plugin for WordPress due to insufficient sanitization of the 'filter' parameter in the Markers REST API endpoint. Specifically, the '_limit' key within the filter JSON bypasses numeric guards and is concatenated directly into the LIMIT clause of a SQL query. An unauthenticated attacker can exploit this by sending a GET request to /wp-json/wpgmza/v1/markers with a crafted 'filter' payload. This allows for differential-based SQL injection to extract data from the database. The issue is fixed in version 10.1.04.
Affected products
- WP Go Maps WP Go Maps < 10.1.04
Timeline
- 2026-07-13: disclosed: Publicly published by WPScan
- 2026-07-31: advisory: NVD publication date
- 10.1.04: patched