Technical impact
Key detail from description: the WP Maps plugin for WordPress is vulnerable to time‑based blind SQL injection via the 'location_id' parameter in all versions up to and including 4.9.1. The flaw allows an unauthenticated attacker to inject additional SQL into existing queries, potentially extracting sensitive database contents. This is a direct instance of CWE-89 because it involves unsanitized user input being passed to a database query.
Affected Systems
Affected are installations of FlipperCode’s WP Maps – Store Locator plugin and its components (Google Maps, OpenStreetMap, Mapbox, Listing, Directory & Filters) running any version up to and including 4.9.1. The vulnerability is present in core files such as class.model.php and wp-google-map-plugin.php as shown in the provided references.
Risk and Exploitability
The CVSS score of 7.5 indicates a high severity, while the EPSS score of less than 1 % suggests a relatively low likelihood of widespread exploitation at present. The vulnerability can be triggered without authentication through the 'wpgmp_ajax_call' AJAX endpoint, meaning an attacker can send crafted requests from any IP. Because the vulnerability allows extraction of proprietary data, it poses a significant threat to confidentiality and integrity of the WordPress database. The plugin is not listed in the CISA KEV catalog, so there are no known large‑scale exploits for this flaw yet, but its ease of exploitation warrants prompt mitigation.
