A SQL injection flaw exists in the Supsystic Ultimate Maps WordPress plugin. The vulnerability is triggered by the 'sidx' GET parameter used by the getListForTbl action. An attacker can inject arbitrary SQL code through this parameter and send crafted GET requests that perform boolean‑based blind or time‑based blind injections, allowing the extraction of sensitive database information.

The affected build is Supsystic Ultimate Maps 1.1.12. While the CPE list includes newer 1.2.x releases, the description confirms exploitation is specific to the 1.1.12 build; administrators should verify the installed version and consider upgrading if possible.

The CVSS score of 8.8 indicates high severity. The attack vector is unauthenticated, remote, and does not require complex conditions beyond sending a crafted request to a public URL. EPSS data is not available and the vulnerability is not listed in the CISA KEV catalog, but the ability to execute arbitrary SQL queries remains a significant risk. Based on the description, it is inferred that an attacker could gather database contents that might later be leveraged for additional attacks, though this is beyond the scope of the described vulnerability.