The vulnerability occurs when the plugin processes the 'orderby' parameter without proper escaping, allowing an attacker to inject arbitrary SQL statements. This flaw enables unauthenticated users to append malicious code to existing queries and extract confidential data from the WordPress database. The weakness corresponds to CWE-89, a classic SQL injection weakness that impacts confidentiality and potentially integrity of stored data.

The affected product is the WP Maps – Store Locator,Google Maps,OpenStreetMap,Mapbox,Listing,Directory & Filters plugin for WordPress, versions 4.9.1 and earlier. The plugin is maintained by FlipperCode. WordPress sites that have this plugin installed and did not upgrade beyond version 4.9.1 are vulnerable.

The CVSS base score is 7.5, indicating a high severity. Exploration of the vulnerability does not require prior authentication, implying that it can be exploited remotely by anyone who can send HTTP requests to the site. The EPSS score is not provided, and the vulnerability is not listed in the CISA KEV catalog, but the high severity combined with the lack of authentication requirement suggests a significant risk of exploitation if the plugin remains at a vulnerable version. An attacker would typically issue a crafted request containing a malicious SQL payload in the 'orderby' parameter of a plugin function.