The MapSVG plugin for WordPress, versions 8.14.0 and earlier, contains a flaw that allows SQL injection when users with contributor-level access submit unfiltered input to the plugin. This vulnerability can enable an attacker to retrieve, modify, or delete data stored in the WordPress database, potentially exposing sensitive site information. This weakness is identified as CWE‑89. Based on the description, it is inferred that the attacker must have contributor access to inject malicious SQL through the plugin’s interface.

RomanCode’s MapSVG plugin versions 8.14.0 and earlier are vulnerable. Users running these versions should verify the installed version and apply a patch to at least 8.14.1, which contains the fix for this SQL injection flaw.

The CVSS score of 8.5 indicates high severity, while the EPSS score of less than 1% implies a low current exploitation probability. The vulnerability is not listed in CISA’s KEV catalog. The likely attack vector is a web-based attacker who has contributor privileges on the WordPress site and can inject SQL via the plugin’s input fields. Exploitation would allow data extraction or more destructive database operations, severely compromising confidentiality.