CVE-2026-39492: WordPress WP Maps plugin <= 4.9.1 - SQL Injection vulnerability

Synopsis

An unauthenticated SQL injection vulnerability affects the WP Maps WordPress plugin at version 4.9.1 and below. The flaw is reachable over the network with no credentials required and no victim interaction needed, making it trivially accessible to any attacker who can reach the WordPress site. Successful exploitation gives the attacker read access to the underlying database and limited ability to disrupt service availability. No upstream fix has been published; HarborGuard tracks the advisory and will make a patched-image rebuild available the moment one is released.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The vulnerable plugin endpoint is exposed over the network, meaning an attacker must be able to reach the WordPress installation via HTTP/HTTPS to exploit it.

• AuthenticationNot required

  No account or session credentials are needed; the injection point is accessible to any anonymous HTTP request.

• Victim interactionNot required

  The attacker sends a crafted request directly to the server and does not need any user to click a link or take any action.

• Attack complexityDetail

  Attack complexity is low, meaning the exploit is reliable and requires no special race conditions, timing windows, or environmental prerequisites.

Blast Radius

• Reads arbitrary database contents including WordPress user records, password hashes, stored session tokens, and any plugin or site configuration data.
• Exposes sensitive application data that may include personally identifiable information, API keys, or private post content stored in the database.
• Causes limited disruption to service availability, consistent with the CVSS A:L impact token, which may manifest as degraded query performance or partial service interruption.
• Because the vulnerability has a changed scope (S:C), successful exploitation may affect database components or server-side processes beyond the WordPress application itself.