The WordPress MapSVG plugin (RomanCode) is affected by an unauthenticated SQL Injection flaw. An attacker can submit crafted input through vulnerable plugin endpoints, causing the application to execute arbitrary SQL statements. This may allow data theft, modification, or deletion of the WordPress database, and is categorized as CWE-89 due to improper sanitization of user‑supplied data.

All installations of the WordPress MapSVG plugin version 8.14.0 or earlier are vulnerable. This includes both the Lite and other variants of the plugin sold by RomanCode. Any WordPress site that has not upgraded past 8.14.0 is susceptible, regardless of whether the plugin is active or has publicly exposed input endpoints.

The CVSS score of 9.3 classifies this as a critical vulnerability, underscoring the severe impact of successful exploitation. The EPSS score is below 1 %, indicating a low probability of exploitation in the wild, and the vulnerability does not appear on the CISA KEV list. Based on the description, it is inferred that the flaw can be exploited remotely through the web interface without needing authentication. Successful exploitation could provide full read/write/erase capabilities against the site’s database, potentially compromising site integrity and confidentiality.