Executive brief
WP Maps, a popular WordPress plugin used for integrating interactive maps into websites, contains a critical security flaw. This vulnerability allows an unauthenticated attacker to interact directly with the website's database without needing a password. An exploit could result in the theft of sensitive customer data, administrative credentials, or a complete compromise of the website's information.
Technical details
The WP Maps plugin for WordPress is vulnerable to an unauthenticated SQL injection (CWE-89) in versions up to 4.9.1. The flaw exists due to improper neutralization of user-supplied input before it is used in an SQL query. A remote, unauthenticated attacker can exploit this by sending specially crafted web requests to the server, allowing them to bypass authentication and execute arbitrary SQL commands. This can lead to the extraction of sensitive information from the database, such as user metadata and site configurations. The vulnerability is patched in version 4.9.2.
Affected products
- WP Maps WP Maps (formerly WP Google Map Plugin) <= 4.9.1
Timeline
- 2026-01-17: other: Vulnerability reported by researcher Nguyen Ba Khanh
- 2026-04-08: advisory: Initial advisory published by Patchstack
- 2026-04-08: patched: Patch released in version 4.9.2
- 2026-06-15: disclosed: CVE published to NVD