CVE-2025-23913: WordPress Google Map Professional SQL Injection

CVE-2025-23913 Overview

CVE-2025-23913 is a SQL Injection vulnerability affecting the google-map-professional WordPress plugin by pankajpragma. The flaw stems from improper neutralization of special elements used in SQL commands [CWE-89]. Authenticated attackers with low privileges can inject crafted SQL statements through vulnerable plugin parameters. The issue affects WordPress Google Map Professional versions up to and including 1.0. Successful exploitation allows attackers to read sensitive database contents and degrade database availability across the WordPress site.

Critical Impact
Authenticated attackers can extract sensitive WordPress database contents, including user credentials and site configuration, by injecting malicious SQL through the plugin.

Affected Products

WordPress Google Map Professional plugin (google-map-professional)
Versions from n/a through <= 1.0
Vendor: pankajpragma

Discovery Timeline

2025-01-16 - CVE-2025-23913 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-23913

Vulnerability Analysis

The vulnerability is classified under [CWE-89], Improper Neutralization of Special Elements used in an SQL Command. The plugin accepts user-supplied input and incorporates it into SQL queries without adequate sanitization or parameterization. An authenticated attacker with low privileges on the WordPress site can supply crafted input that alters the structure of underlying queries.

Because the CVSS scope is changed, the impact extends beyond the vulnerable component to other resources managed by WordPress, including the broader database schema. Confidentiality impact is high, allowing extraction of arbitrary table contents such as wp_users password hashes and secret keys. Availability impact is low, reflecting potential query disruption rather than full database destruction.

Root Cause

The root cause is the failure to use prepared statements or properly escape user input through WordPress APIs such as $wpdb->prepare(). Input arriving from HTTP request parameters is concatenated directly into SQL queries executed against the WordPress MySQL backend. This violates standard WordPress secure coding guidance for database interaction.

Attack Vector

The attack vector is network-based and requires low-privileged authentication. An attacker uses an existing WordPress account, typically subscriber or contributor level, to reach the vulnerable plugin endpoint. The attacker submits malicious SQL payloads via parameters processed by the plugin. Typical payloads use UNION SELECT statements or boolean-based blind injection to exfiltrate data from arbitrary tables.

No verified public exploit code is available. Technical details are documented in the Patchstack Vulnerability Report.

Detection Methods for CVE-2025-23913

Indicators of Compromise

HTTP requests to google-map-professional plugin endpoints containing SQL metacharacters such as ', ", UNION, SELECT, --, or OR 1=1.
Unexpected database errors logged by WordPress or MySQL referencing plugin-related queries.
Unusual outbound data flows from the WordPress host following authenticated sessions.
New or modified administrator accounts in the wp_users table without corresponding admin activity.

Detection Strategies

Inspect web server access logs for requests to plugin URIs with SQL injection patterns in query strings or POST bodies.
Enable MySQL general query logging temporarily to identify malformed or anomalous queries from the WordPress process.
Deploy a web application firewall ruleset that flags SQL injection signatures targeting WordPress plugins.

Monitoring Recommendations

Monitor authentication logs for low-privilege accounts performing repeated plugin requests.
Alert on spikes in 500 errors or database exceptions tied to the plugin path.
Track installed plugin versions across WordPress fleets to identify hosts running google-map-professional version 1.0 or earlier.

How to Mitigate CVE-2025-23913

Immediate Actions Required

Deactivate and remove the google-map-professional plugin until a patched release is confirmed by the vendor.
Restrict new account registration and review existing low-privilege accounts for suspicious activity.
Rotate WordPress secret keys in wp-config.php and reset passwords for all administrative users if exploitation is suspected.
Audit the wp_users and wp_options tables for unauthorized modifications.

Patch Information

At the time of publication, no fixed version is listed for WordPress Google Map Professional. The vulnerability affects all versions up to and including 1.0. Consult the Patchstack Vulnerability Report for current remediation guidance and any subsequent vendor updates.

Workarounds

Remove the plugin from production WordPress installations until a vendor patch is released.
Deploy a WAF rule that blocks SQL injection patterns in requests targeting /wp-content/plugins/google-map-professional/.
Apply principle of least privilege by limiting account creation and reviewing user roles.
Place the WordPress database user behind least-privilege grants to limit damage from injection.

bash

# Example: WAF rule snippet (ModSecurity) blocking SQLi attempts to the plugin path
SecRule REQUEST_URI "@contains /wp-content/plugins/google-map-professional/" \
    "id:1009231,phase:2,deny,status:403,\
     msg:'Block SQLi attempt against google-map-professional (CVE-2025-23913)',\
     chain"
  SecRule ARGS "@rx (?i)(union(\s|/\*.*\*/)+select|--|/\*|;\s*drop|or\s+1=1)" \
    "t:none,t:urlDecodeUni"