Is CVE-2026-59526 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-59526 being exploited in the wild.

How severe is CVE-2026-59526?

Critical severity, with a CVSS score of 9.3, published 23 July 2026.

Which products and versions are affected?

RomanCode / PT Norther Lights Production MapSVG <= 8.14.0.

Is there a fix for CVE-2026-59526?

A patch was published on 2026-07-23: Version 8.14.1 released to address the issue Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-59526 attacked?

It is attacked over the network, in a web application.

Am I affected by CVE-2026-59526?

Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-59526: RomanCode MapSVG unauthenticated SQL injection

Q: Is there a fix for CVE-2026-59526?

A patch was published on 2026-07-23: Version 8.14.1 released to address the issue Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-59526 attacked?

It is attacked over the network, in a web application.

Q: Am I affected by CVE-2026-59526?

Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-59526 · Severity: critical · CVSS 9.3 · Published 2026-07-23

MapSVG, a WordPress plugin used for creating interactive maps, contains a critical security flaw that allows unauthorized individuals to interact with the website's database. An attacker could exploit this to steal sensitive information, such as user data or configuration details, without needing any login credentials. This type of vulnerability is frequently targeted in automated mass-exploitation campaigns against websites.

Quick answers

Is CVE-2026-59526 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-59526 being exploited in the wild.
How severe is CVE-2026-59526?: Critical severity, with a CVSS score of 9.3, published 23 July 2026.
Which products and versions are affected?: RomanCode / PT Norther Lights Production MapSVG <= 8.14.0.
Is there a fix for CVE-2026-59526?: A patch was published on 2026-07-23: Version 8.14.1 released to address the issue Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-59526 attacked?: It is attacked over the network, in a web application.
Am I affected by CVE-2026-59526?: Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A SQL injection vulnerability exists in the MapSVG WordPress plugin (versions <= 8.14.0) due to improper neutralization of special elements used in SQL commands (CWE-89). The flaw is exploitable by unauthenticated remote attackers over the network with low attack complexity. Because the vulnerability does not require user interaction or privileges, it poses a high risk of automated exploitation. Successful exploitation allows an attacker to execute arbitrary SQL queries, potentially leading to full data exfiltration from the WordPress database. The issue is resolved in version 8.14.1.

Affected products

RomanCode / PT Norther Lights Production MapSVG <= 8.14.0

Timeline

2026-01-23: other: Reported by Trương Hữu Phúc
2026-07-23: disclosed: Vulnerability published by Patchstack
2026-07-23: patched: Version 8.14.1 released to address the issue

References

https://patchstack.com/database/wordpress/plugin/mapsvg/vulnerability/wordpress-mapsvg-plugin-8-14-0-sql-injection-vulnerability-3?_s_id=cve

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.