# CVE-2026-15381: WP Go Maps SQL injection in Markers REST filter

Source: https://junglewise.ai/threats/cve-2026-15381-wp-go-maps-sql-injection-in-markers-rest-filter  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-07-31. Updated: 2026-07-31  
License: CC BY 4.0 with a link back

CVE-2026-15381 · Severity: info · CVSS 0 · Published 2026-07-31

WP Go Maps is a popular WordPress plugin used to add interactive maps to websites. A security flaw in the plugin allows unauthorized individuals to manipulate database queries by sending specially crafted requests to the map's data interface. This could allow an attacker to access sensitive information from the website's database without needing a username or password.

Technologies: [WP Go Maps](https://junglewise.ai/threats/technologies/wp-go-maps). Vendors: [WP Go Maps](https://junglewise.ai/threats/vendors/wp-go-maps).

## Quick answers

**Is CVE-2026-15381 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-15381 being exploited in the wild.

**How severe is CVE-2026-15381?** Informational severity, with a CVSS score of 0, published 31 July 2026.

**Which products and versions are affected?** WP Go Maps < 10.1.04.

**Is there a fix for CVE-2026-15381?** A patch was published on 10.1.04. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-15381 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-15381?** Check whether you run WP Go Maps at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A SQL injection vulnerability exists in the WP Go Maps plugin for WordPress due to insufficient sanitization of the 'filter' parameter in the Markers REST API endpoint. Specifically, the '_limit' key within the filter JSON bypasses numeric guards and is concatenated directly into the LIMIT clause of a SQL query. An unauthenticated attacker can exploit this by sending a GET request to /wp-json/wpgmza/v1/markers with a crafted 'filter' payload. This allows for differential-based SQL injection to extract data from the database. The issue is fixed in version 10.1.04.

## Affected products

- WP Go Maps WP Go Maps < 10.1.04

## Timeline

- 2026-07-13: disclosed: Publicly published by WPScan
- 2026-07-31: advisory: NVD publication date
- 10.1.04: patched

## References

- [https://wpscan.com/vulnerability/9676af2f-8871-4715-b420-082b1afeb7b4/](https://wpscan.com/vulnerability/9676af2f-8871-4715-b420-082b1afeb7b4/)

## Related threats

- [WP Go Maps denial of service in map rendering](https://junglewise.ai/threats/cve-2026-84780-wp-go-maps-denial-of-service-in-map-rendering)
- [WPGMaps WP Go Maps broken access control](https://junglewise.ai/threats/cve-2026-25466-wpgmaps-wp-go-maps-broken-access-control)
- [WP Go Maps WordPress plugin authorization bypass in REST API](https://junglewise.ai/threats/cve-2026-12238-wp-go-maps-wordpress-plugin-authorization-bypass-in-rest-api)
- [WP Go Maps information disclosure in single-marker REST endpoint](https://junglewise.ai/threats/cve-2026-8386-wp-go-maps-information-disclosure-in-single-marker-rest-endpoint)
- [WP Go Maps information disclosure in Datatables AJAX fallback](https://junglewise.ai/threats/cve-2026-8385-wp-go-maps-information-disclosure-in-datatables-ajax-fallback)