MapSVG – Vector maps, Image maps, Google Maps <= 8.16.1 - Authenticated (Contributor+) SQL Injection via Schema Field Definitions
- ID
- WPSEC-2026-1162
- Plugin
- MapSVG – Vector maps, Image maps, Google Maps (mapsvg-lite-interactive-vector-maps)
- Affected
- all versions before 8.16.2
- Remediation
- Update to 8.16.2 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
- Weakness
- CWE-89
- Usage
- Plugin Low · Affected versions None seen among sites WPSec scans, 2026-10-16
- Attack surface
- MapSVG – Vector maps, Image maps, Google Maps on WPSec AttackSurface
- Fix released
- Published
Description
The MapSVG plugin for WordPress is vulnerable to SQL Injection via schema field definitions in all versions up to, and including, 8.16.1 due to field names, database types, default values and option labels being concatenated directly into CREATE TABLE, ALTER TABLE and UPDATE queries without validation or escaping. The CREATE TABLE statement is passed to dbDelta() as a string, which splits it on semicolons and runs any INSERT or UPDATE statements it finds. The schema create and update REST routes only required the edit_posts capability. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject additional SQL, including separate INSERT and UPDATE statements, which can be used to extract or modify sensitive information in the database.
References
- https://wpsec.com/vuln/WPSEC-2026-1162/
- https://plugins.svn.wordpress.org/mapsvg-lite-interactive-vector-maps/tags/8.16.2/
- https://wordpress.org/plugins/mapsvg-lite-interactive-vector-maps/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS