# MapSVG – Vector maps, Image maps, Google Maps <= 8.16.1 - Authenticated (Contributor+) SQL Injection via Schema Field Definitions

- **ID:** WPSEC-2026-1162
- **Plugin:** MapSVG – Vector maps, Image maps, Google Maps (`mapsvg-lite-interactive-vector-maps`), https://wordpress.org/plugins/mapsvg-lite-interactive-vector-maps/
- **Affected versions:** all versions before 8.16.2
- **Fixed in:** 8.16.2 (Update to 8.16.2 or later.)
- **Severity:** High 8.8 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
- **Weakness:** CWE-89
- **Usage among sites WPSec scans:** plugin Low, affected versions None seen (as of 2026-10-17)
- **Attack surface analysis:** https://attacksurface.wpsec.com/plugin/mapsvg-lite-interactive-vector-maps
- **Fix released:** 2026-10-16
- **Published:** 2026-10-17
- **URL:** https://wpsec.com/vuln/WPSEC-2026-1162/

## Description

The MapSVG plugin for WordPress is vulnerable to SQL Injection via schema field definitions in all versions up to, and including, 8.16.1 due to field names, database types, default values and option labels being concatenated directly into CREATE TABLE, ALTER TABLE and UPDATE queries without validation or escaping. The CREATE TABLE statement is passed to dbDelta() as a string, which splits it on semicolons and runs any INSERT or UPDATE statements it finds. The schema create and update REST routes only required the edit_posts capability. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject additional SQL, including separate INSERT and UPDATE statements, which can be used to extract or modify sensitive information in the database.

## References

- https://wpsec.com/vuln/WPSEC-2026-1162/
- https://plugins.svn.wordpress.org/mapsvg-lite-interactive-vector-maps/tags/8.16.2/
- https://wordpress.org/plugins/mapsvg-lite-interactive-vector-maps/

Source: WPSec, https://wpsec.com/vuln/WPSEC-2026-1162/

License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Free to use, share and adapt, also commercially, if you credit WPSec and link to this advisory.