CVE-2026-15381: WP Go Maps WordPress Plugin SQLi Flaw

CVE-2026-15381 Overview

CVE-2026-15381 is a SQL injection vulnerability in the WP Go Maps WordPress plugin affecting versions prior to 10.1.04. The plugin fails to sanitize and escape a user-supplied parameter before including it in a SQL query. Unauthenticated remote attackers can inject SQL statements through the vulnerable parameter. The flaw is classified under CWE-89 (Improper Neutralization of Special Elements used in an SQL Command).

The issue carries a CVSS 3.1 score of 3.7 and an EPSS probability of 0.178%. Successful exploitation requires overcoming attack complexity conditions, and impact is limited to a partial confidentiality loss without integrity or availability effects.

Critical Impact
Unauthenticated attackers can execute SQL injection against WordPress sites running WP Go Maps before 10.1.04, potentially extracting limited data from the underlying database.

Affected Products

WP Go Maps WordPress plugin versions prior to 10.1.04
WordPress sites with the WP Go Maps plugin installed and activated
Any hosting environment exposing the vulnerable plugin endpoint to the internet

Discovery Timeline

2026-07-31 - CVE-2026-15381 published to the National Vulnerability Database (NVD)
2026-07-31 - Last updated in NVD database

Technical Details for CVE-2026-15381

Vulnerability Analysis

The WP Go Maps plugin processes a request parameter and passes it into a SQL query without applying proper sanitization or escaping. Because the plugin does not use prepared statements or parameterized queries for the affected code path, attacker-controlled input alters query structure. This enables SQL injection against the WordPress database.

The attack requires no authentication, meaning any anonymous visitor can send a crafted HTTP request. Exploitation targets the WordPress wp_ prefixed tables through the plugin's query interface. Full technical detail is available in the WPScan Vulnerability Detail advisory.

Root Cause

The root cause is missing input validation on a request parameter consumed by the plugin's SQL query builder. WordPress provides $wpdb->prepare() for parameterized queries, but the vulnerable code path concatenates the raw parameter into the SQL string. This design fault permits arbitrary SQL fragments to reach the database engine.

Attack Vector

Attackers deliver malicious payloads over the network using standard HTTP requests to a WordPress site exposing the WP Go Maps plugin. No user interaction and no privileges are required. Attack complexity is rated High, indicating that specific conditions such as blind extraction techniques or timing-based inference may be needed to retrieve data. The vulnerability affects confidentiality only, with no direct write or denial-of-service impact per the CVSS vector.

Because no verified proof-of-concept code has been published, exploitation specifics should be reviewed in the WPScan Vulnerability Detail advisory rather than reconstructed from synthetic samples.

Detection Methods for CVE-2026-15381

Indicators of Compromise

HTTP requests to WP Go Maps plugin endpoints containing SQL metacharacters such as ', --, UNION SELECT, or SLEEP(
Web server access logs showing repeated requests with encoded SQL keywords targeting the plugin's parameters
Unexpected slow response times on plugin endpoints, indicating possible time-based blind SQL injection probing
Database error messages appearing in application logs originating from plugin queries

Detection Strategies

Deploy web application firewall (WAF) signatures matching common SQL injection patterns on requests to /wp-admin/admin-ajax.php and WP Go Maps REST routes
Inspect PHP error logs and MySQL general query logs for malformed statements referencing plugin tables
Compare installed plugin version to 10.1.04 using WP-CLI or the WordPress admin dashboard

Monitoring Recommendations

Baseline request volume and payload length to WP Go Maps endpoints and alert on anomalies
Forward WordPress and web server logs to a central log platform for correlation with authentication events
Track outbound database query volume for spikes that align with anonymous inbound requests

How to Mitigate CVE-2026-15381

Immediate Actions Required

Upgrade the WP Go Maps plugin to version 10.1.04 or later through the WordPress plugin manager
Audit web server access logs for prior requests matching SQL injection patterns against the plugin
Rotate database credentials if evidence of exploitation is found
Restrict administrative access to the WordPress site while patching is verified

Patch Information

The vendor addressed CVE-2026-15381 in WP Go Maps version 10.1.04. Site operators should apply the update using the WordPress admin interface or wp plugin update wp-google-maps via WP-CLI. Refer to the WPScan Vulnerability Detail for advisory metadata.

Workarounds

Deactivate the WP Go Maps plugin until the update to 10.1.04 is applied
Deploy a WAF rule blocking SQL metacharacters on requests to plugin endpoints if immediate patching is not possible
Limit access to WordPress AJAX and REST endpoints from untrusted networks using IP allowlists at the reverse proxy

bash

# Configuration example
wp plugin update wp-google-maps --version=10.1.04
wp plugin list --name=wp-google-maps --fields=name,status,version