The WP Go Maps WordPress plugin versions earlier than 10.1.04 fails to properly sanitise a user supplied parameter that is incorporated directly into a SQL query. This flaw allows an attacker without authentication to inject arbitrary SQL code, potentially enabling data exfiltration, modification, or deletion of the site database. The vulnerability is a classic SQL injection, classified under CWE‑89. The impact is that confidentiality, integrity, and availability of the site’s data could be compromised if exploited.

This issue affects installations of the WP Go Maps plugin prior to version 10.1.04. Users of any older version are susceptible, regardless of other plugins or WordPress core versions. The plugin’s REST endpoint that accepts the markers filter is the entry point. No evidence indicates additional products or components are impacted.

Because the flaw is unauthenticated, any user with network access to the site can craft malicious requests. The CVSS score of 3.7 indicates a low‑to‑moderate severity, while the EPSS score of < 1% suggests a low probability of exploitation. The vulnerability is not listed in CISA KEV. Despite these metrics, the flaw remains publicly documented and can be exploited by an attacker who identifies an eligible REST endpoint.