{
 "id": "WPSEC-2026-1162",
 "url": "https://wpsec.com/vuln/WPSEC-2026-1162/",
 "json_url": "https://wpsec.com/vuln/WPSEC-2026-1162/advisory.json",
 "markdown_url": "https://wpsec.com/vuln/WPSEC-2026-1162/index.md",
 "title": "MapSVG – Vector maps, Image maps, Google Maps <= 8.16.1 - Authenticated (Contributor+) SQL Injection via Schema Field Definitions",
 "description": "The MapSVG plugin for WordPress is vulnerable to SQL Injection via schema field definitions in all versions up to, and including, 8.16.1 due to field names, database types, default values and option labels being concatenated directly into CREATE TABLE, ALTER TABLE and UPDATE queries without validation or escaping. The CREATE TABLE statement is passed to dbDelta() as a string, which splits it on semicolons and runs any INSERT or UPDATE statements it finds. The schema create and update REST routes only required the edit_posts capability. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject additional SQL, including separate INSERT and UPDATE statements, which can be used to extract or modify sensitive information in the database.",
 "plugin": {
  "slug": "mapsvg-lite-interactive-vector-maps",
  "name": "MapSVG – Vector maps, Image maps, Google Maps",
  "full_name": "MapSVG – Vector maps, Image maps, Google Maps",
  "wordpress_org": "https://wordpress.org/plugins/mapsvg-lite-interactive-vector-maps/",
  "advisories_url": "https://wpsec.com/vuln/plugin/mapsvg-lite-interactive-vector-maps/",
  "attacksurface": "https://attacksurface.wpsec.com/plugin/mapsvg-lite-interactive-vector-maps"
 },
 "type": "SQLI",
 "cwe": [
  "CWE-89"
 ],
 "cve": [],
 "cvss": {
  "version": "3.1",
  "score": 8.8,
  "vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
  "severity": "High"
 },
 "affected": {
  "ranges": [
   {
    "from": null,
    "from_inclusive": true,
    "to": "8.16.2",
    "to_inclusive": false
   }
  ],
  "text": [
   "all versions before 8.16.2"
  ]
 },
 "introduced_in": null,
 "fixed_in": "8.16.2",
 "remediation": "Update to 8.16.2 or later.",
 "fix_released": "2026-10-16T05:12:27+00:00",
 "published": "2026-10-17T05:42:11+00:00",
 "updated": "2026-10-16T09:50:39.472867+00:00",
 "also_published_as": null,
 "references": [
  "https://wpsec.com/vuln/WPSEC-2026-1162/",
  "https://plugins.svn.wordpress.org/mapsvg-lite-interactive-vector-maps/tags/8.16.2/",
  "https://wordpress.org/plugins/mapsvg-lite-interactive-vector-maps/"
 ],
 "attacksurface_url": "https://attacksurface.wpsec.com/plugin/mapsvg-lite-interactive-vector-maps",
 "source": "WPSec",
 "license": {
  "name": "CC BY 4.0",
  "url": "https://creativecommons.org/licenses/by/4.0/"
 },
 "usage": {
  "plugin": "Low",
  "affected_versions": "None seen",
  "as_of": "2026-10-17"
 }
}