CVE-2024-31116: 10Web Map Builder For Google Maps SQL Injection

CVE-2024-31116 Overview

CVE-2024-31116 is a SQL injection vulnerability in the 10Web Map Builder for Google Maps plugin for WordPress. The flaw affects all versions of the plugin from initial release through 1.0.74. An authenticated attacker with high privileges can inject arbitrary SQL statements into database queries by supplying crafted input to vulnerable plugin parameters. Successful exploitation compromises the confidentiality, integrity, and availability of the underlying WordPress database. The vulnerability is tracked under CWE-89: Improper Neutralization of Special Elements used in an SQL Command.

Critical Impact
Authenticated attackers can execute arbitrary SQL queries against the WordPress database, exposing site data, modifying content, and potentially escalating access across the WordPress instance.

Affected Products

10Web Map Builder for Google Maps (WordPress plugin)
All versions from initial release through 1.0.74
WordPress sites with the plugin installed and active

Discovery Timeline

2024-03-31 - CVE-2024-31116 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-31116

Vulnerability Analysis

The 10Web Map Builder for Google Maps plugin fails to properly neutralize special SQL characters in user-supplied input before incorporating that input into database queries. The plugin passes attacker-controlled parameters into SQL statements without adequate sanitization or parameterized query construction. This allows an authenticated attacker with elevated privileges to alter query logic and execute arbitrary SQL commands against the WordPress database.

The vulnerability requires authentication with high privileges but does not require user interaction. Because the plugin runs within the WordPress database context, exploitation exposes all tables accessible to the WordPress database user, including wp_users and wp_usermeta.

Root Cause

The root cause is improper neutralization of special elements in SQL commands, classified as [CWE-89]. The plugin concatenates request parameters directly into SQL query strings rather than using WordPress prepared statements such as $wpdb->prepare(). Any special SQL syntax within input parameters is interpreted as part of the query.

Attack Vector

An attacker authenticated to WordPress with sufficient privileges sends crafted HTTP requests to plugin endpoints that process map builder data. The malicious payload includes SQL metacharacters and query fragments injected into vulnerable parameters. The plugin passes the tainted input to the database layer, where the injected SQL executes with the privileges of the WordPress database user. Refer to the Patchstack SQL Injection Advisory for additional technical detail.

Detection Methods for CVE-2024-31116

Indicators of Compromise

Unexpected SQL syntax such as UNION SELECT, SLEEP(, or information_schema appearing in HTTP request parameters targeting plugin endpoints under /wp-admin/admin.php or /wp-admin/admin-ajax.php.
Anomalous wpdb query patterns in WordPress debug logs referencing map builder actions.
New or modified rows in wp_users, wp_usermeta, or wp_options that do not correspond to legitimate administrative activity.

Detection Strategies

Inspect web server access logs for authenticated requests to 10Web Map Builder endpoints containing SQL metacharacters, encoded quotes (%27), or comment sequences (--, #).
Enable WordPress query logging and alert on plugin-originated queries that reference sensitive tables outside the plugin's normal data model.
Deploy a web application firewall (WAF) rule set that flags SQL injection patterns on plugin admin routes.

Monitoring Recommendations

Monitor authenticated admin sessions for privilege changes and new administrator accounts created after plugin activity.
Alert on outbound database dumps, large SELECT result sets, or long-running queries originating from the WordPress process.
Track plugin version inventory across WordPress deployments and flag any host still running 1.0.74 or earlier.

How to Mitigate CVE-2024-31116

Immediate Actions Required

Update the 10Web Map Builder for Google Maps plugin to a version released after 1.0.74 that addresses the SQL injection issue.
Audit WordPress user accounts and revoke unnecessary high-privilege roles, since exploitation requires authenticated privileged access.
Review database contents and administrative activity for signs of unauthorized modification following the disclosure date.

Patch Information

Refer to the Patchstack SQL Injection Advisory for the current fixed version guidance. Apply the vendor-supplied update through the WordPress plugin manager or WP-CLI as soon as it is available in the target environment.

Workarounds

Deactivate and remove the 10Web Map Builder for Google Maps plugin until an updated version can be installed.
Restrict access to WordPress administrative endpoints using network controls, IP allowlisting, or an authenticating reverse proxy.
Deploy WAF signatures that block SQL injection payloads targeting the plugin's request parameters.

bash

# Configuration example: identify and disable the vulnerable plugin using WP-CLI
wp plugin list --name=wd-google-maps --fields=name,status,version
wp plugin deactivate wd-google-maps
wp plugin update wd-google-maps