# CVE-2026-66618: WP Maps SQL injection

Source: https://junglewise.ai/threats/cve-2026-66618-wp-maps-sql-injection  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-17. Updated: 2026-09-26  
License: CC BY 4.0 with a link back

CVE-2026-66618 · Severity: high · CVSS 7.6 · Published 2026-09-17

WP Maps is a popular WordPress plugin for embedding maps on websites. A SQL injection vulnerability in versions 4.9.9 and earlier allows authenticated administrators to read, modify, or delete the entire database, including user credentials and sensitive data stored in WordPress. This could lead to complete site compromise and data loss.

Technologies: [WP Maps](https://junglewise.ai/threats/technologies/wp-maps). Vendors: [WP Maps](https://junglewise.ai/threats/vendors/wp-maps).

## Quick answers

**Is CVE-2026-66618 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-66618 being exploited in the wild.

**How severe is CVE-2026-66618?** High severity, with a CVSS score of 7.6, published 17 September 2026.

**Which products and versions are affected?** WP Maps <=4.9.9.

**Is there a fix for CVE-2026-66618?** A patch was published on 2026-09-17: Patched in version 5.0.0 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-66618 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-66618?** Check whether you run WP Maps at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The WP Maps plugin versions 4.9.9 and earlier contain a SQL injection vulnerability that requires administrator-level privileges to exploit. The vulnerability stems from insufficient input sanitization in a database query operation. An authenticated administrator can craft malicious SQL statements to access, modify, or delete database records. While the attack requires authentication at the admin level, successful exploitation enables full database disclosure and manipulation, including extraction of user passwords and sensitive information. The vulnerability has been patched in version 5.0.0.

## Affected products

- WP Maps WP Maps <=4.9.9

## Timeline

- 2026-09-17: disclosed: Published by Patchstack
- 2026-09-17: patched: Patched in version 5.0.0

## References

- [https://wordpress.org/plugins](https://wordpress.org/plugins)
- [https://patchstack.com/database/wordpress/plugin/wp-google-map-plugin/vulnerability/wordpress-wp-maps-plugin-4-9-9-sql-injection-vulnerability?_s_id=cve](https://patchstack.com/database/wordpress/plugin/wp-google-map-plugin/vulnerability/wordpress-wp-maps-plugin-4-9-9-sql-injection-vulnerability?_s_id=cve)

## Related threats

- [WP Maps SQL injection in WordPress plugin](https://junglewise.ai/threats/cve-2026-39492-wp-maps-sql-injection-in-wordpress-plugin)
- [WP Maps WordPress plugin Stored XSS in location_messages parameter](https://junglewise.ai/threats/cve-2026-9594-wp-maps-wordpress-plugin-stored-xss-in-location-messages-parameter)
- [WP Maps WordPress plugin local file inclusion](https://junglewise.ai/threats/cve-2026-6381-wp-maps-wordpress-plugin-local-file-inclusion)