CVE-2026-2580: WP Maps Plugin SQL Injection Vulnerability

CVE-2026-2580 Overview

The WP Maps – Store Locator, Google Maps, OpenStreetMap, Mapbox, Listing, Directory & Filters plugin for WordPress is vulnerable to time-based SQL Injection via the orderby parameter in all versions up to, and including, 4.9.1. This vulnerability exists due to insufficient escaping on the user-supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.

Critical Impact

Unauthenticated attackers can exploit this SQL Injection vulnerability to extract sensitive information from the WordPress database, including user credentials, personally identifiable information, and other confidential data stored within the site's database.

Affected Products

• WP Maps – Store Locator, Google Maps, OpenStreetMap, Mapbox, Listing, Directory & Filters plugin for WordPress versions up to and including 4.9.1
• WordPress installations using the vulnerable WP Google Map Plugin (wp-google-map-plugin)

Discovery Timeline

• 2026-03-23 - CVE-2026-2580 published to NVD
• 2026-03-23 - Last updated in NVD database

Technical Details for CVE-2026-2580

Vulnerability Analysis

This vulnerability is classified as CWE-89: SQL Injection. The flaw allows unauthenticated remote attackers to manipulate SQL queries through the orderby parameter. Due to the time-based nature of this SQL injection, attackers can infer database contents by measuring response times, making it possible to systematically extract sensitive data without direct error messages being returned to the attacker.

The vulnerability enables attackers to access any data accessible to the database user configured for the WordPress installation. This typically includes user account information, posts, comments, plugin settings, and potentially sensitive business data stored by other plugins or custom functionality.

Root Cause

The root cause of this vulnerability is insufficient input validation and improper SQL query construction. The plugin fails to properly escape or parameterize the orderby parameter before incorporating it into SQL queries. According to the WordPress Plugin Code Review, the vulnerable code path can be traced through multiple files including wpgmp-helper.php, class.tabular.php, and the main plugin file.

The absence of WordPress's $wpdb->prepare() function or equivalent prepared statements allows user-controlled input to directly influence the SQL query structure, enabling injection attacks.

Attack Vector

The attack can be executed remotely over the network without requiring any authentication or user interaction. Attackers can craft malicious requests containing specially crafted orderby parameter values that include SQL injection payloads. By using time-based techniques such as SLEEP() or BENCHMARK() functions, attackers can exfiltrate data character by character based on conditional response delays.

The vulnerability is exploited by sending HTTP requests to WordPress endpoints that process the vulnerable orderby parameter, injecting SQL syntax that causes conditional time delays when certain conditions are true.

Detection Methods for CVE-2026-2580

Indicators of Compromise

• Unusual database query patterns with abnormally long execution times
• HTTP requests containing SQL injection patterns in the orderby parameter (e.g., SLEEP(), BENCHMARK(), WAITFOR DELAY)
• Web server logs showing requests with encoded SQL characters targeting WP Maps plugin endpoints
• Database logs indicating time-based or conditional queries that deviate from normal plugin behavior

Detection Strategies

• Implement Web Application Firewall (WAF) rules to detect and block SQL injection patterns in request parameters
• Monitor web server access logs for requests containing suspicious characters or SQL keywords in query strings
• Enable WordPress database query logging to identify abnormal query patterns
• Deploy intrusion detection systems with signatures for time-based SQL injection techniques

Monitoring Recommendations

• Configure real-time alerting for SQL injection attempt patterns in security monitoring tools
• Establish baseline metrics for database query performance to detect anomalous delays indicative of time-based attacks
• Review WordPress plugin update notifications regularly for security patches
• Implement continuous vulnerability scanning for WordPress installations

How to Mitigate CVE-2026-2580

Immediate Actions Required

• Update the WP Maps plugin to the latest patched version immediately
• Temporarily disable the WP Maps plugin if an update is not yet available
• Implement WAF rules to filter malicious orderby parameter values
• Review database access logs for signs of prior exploitation
• Consider changing database credentials if compromise is suspected

Patch Information

Organizations should check the Wordfence Vulnerability Report for the latest patch information and update to a version higher than 4.9.1 when available. The vulnerable code can be reviewed in the WordPress plugin repository through the technical references provided.

Workarounds

• Implement input validation at the web server or reverse proxy level to sanitize the orderby parameter
• Deploy a WAF with SQL injection protection rules enabled
• Restrict network access to WordPress admin and plugin endpoints where possible
• Consider using WordPress security plugins that provide virtual patching capabilities
• Temporarily disable the plugin until an official patch is released

# WAF rule example to block SQL injection in orderby parameter
# ModSecurity rule to detect time-based SQL injection
SecRule ARGS:orderby "@rx (?i)(sleep|benchmark|waitfor|delay|pg_sleep)" \
    "id:100001,phase:2,deny,status:403,log,msg:'SQL Injection attempt in orderby parameter'"