Improper neutralization of special elements in an SQL command creates an injection flaw that allows attackers to send malicious input that is directly incorporated into database queries. The vulnerability is identified as CWE‑89 and has a CVSS score of 9.3, indicating a high severity risk. A successful exploitation could give the attacker the ability to read, modify or delete database information, thereby compromising data confidentiality and integrity.

This flaw affects the RomanCode MapSVG WordPress plugin in all releases up to, but not including, version 8.7.4. Systems running any earlier version of the plugin are potentially exposed.

The EPSS score of <1% suggests that exploitation occurrences are infrequent. The vulnerability is not listed in CISA’s KEV catalog. An attacker would need to submit a request that contains crafted SQL fragments. Based on the description, the likely attack vector is a web request directed at the plugin’s endpoints, though this is inferred and not explicitly stated. The high CVSS score indicates that a successful exploit would have severe impact on confidentiality and integrity of the underlying database.