The WP Google Map Plugin for WordPress contains a blind SQL Injection flaw in the 'id' parameter of the 'google_map' shortcode. The plugin fails to properly escape or prepare the user supplied value, allowing an authenticated user with Contributor-level access or higher to inject additional SQL statements into the underlying query. This flaw can be leveraged to read private data from the database, such as user credentials or sensitive content, without affecting code execution on the server.

WordPress sites installing WP Google Map Plugin version 1.0 or earlier are vulnerable. The plugin is distributed by the author akbrohi and is commonly used in standard WordPress installations. No specific WordPress core version is mentioned, so all WordPress deployments that include this plugin version are impacted.

The CVSS score of 6.5 indicates moderate severity, and the EPSS score of less than 1% shows a very low exploitation probability at the time of analysis. The vulnerability is not listed in the CISA KEV catalog. The required audience are authenticated users with Contributor privileges, meaning an attacker must first compromise an account or gain access to an account with sufficient permissions. Once the permission threshold is met, the attacker can run arbitrary SQL queries against the database.