CVE-2026-2580

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-2580", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "state": "PUBLISHED", "assignerShortName": "Wordfence", "dateReserved": "2026-02-16T10:43:01.261Z", "datePublished": "2026-03-22T23:24:31.957Z", "dateUpdated": "2026-04-08T17:06:12.447Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T17:06:12.447Z"}, "affected": [{"vendor": "flippercode", "product": "WP Maps \u2013 Store Locator,Google Maps,OpenStreetMap,Mapbox,Listing,Directory & Filters", "versions": [{"version": "0", "status": "affected", "lessThanOrEqual": "4.9.1", "versionType": "semver"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "The WP Maps \u2013 Store Locator,Google Maps,OpenStreetMap,Mapbox,Listing,Directory & Filters plugin for WordPress is vulnerable to time-based SQL Injection via the \u2018orderby\u2019 parameter in all versions up to, and including, 4.9.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database."}], "title": "WP Maps \u2013 Store Locator,Google Maps,OpenStreetMap,Mapbox,Listing,Directory & Filters <= 4.9.1 - Unauthenticated SQL Injection via 'orderby' Parameter", "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/8d954868-eff2-497d-84e7-cc42da8a4c6f?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/wp-google-map-plugin/tags/4.9.1/core/class.tabular.php#L780"}, {"url": "https://plugins.trac.wordpress.org/browser/wp-google-map-plugin/tags/4.9.1/classes/wpgmp-helper.php#L127"}, {"url": "https://plugins.trac.wordpress.org/browser/wp-google-map-plugin/tags/4.9.1/wp-google-map-plugin.php#L77"}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')", "cweId": "CWE-89", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "baseScore": 7.5, "baseSeverity": "HIGH"}}], "credits": [{"lang": "en", "type": "finder", "value": "Chiao-Lin Yu"}], "timeline": [{"time": "2026-02-07T00:00:00.000Z", "lang": "en", "value": "Discovered"}, {"time": "2026-02-27T04:48:32.000Z", "lang": "en", "value": "Vendor Notified"}, {"time": "2026-03-22T11:17:17.000Z", "lang": "en", "value": "Disclosed"}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-03-23T13:59:01.904424Z", "id": "CVE-2026-2580", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-23T13:59:09.831Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"cna": {"title": "WP Maps \u2013 Store Locator,Google Maps,OpenStreetMap,Mapbox,Listing,Directory & Filters <= 4.9.1 - Unauthenticated SQL Injection via 'orderby' Parameter", "credits": [{"lang": "en", "type": "finder", "value": "Chiao-Lin Yu"}], "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 7.5, "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"}}], "affected": [{"vendor": "flippercode", "product": "WP Maps \u2013 Store Locator,Google Maps,OpenStreetMap,Mapbox,Listing,Directory & Filters", "versions": [{"status": "affected", "version": "*", "versionType": "semver", "lessThanOrEqual": "4.9.1"}], "defaultStatus": "unaffected"}], "timeline": [{"lang": "en", "time": "2026-02-07T00:00:00.000Z", "value": "Discovered"}, {"lang": "en", "time": "2026-02-27T04:48:32.000Z", "value": "Vendor Notified"}, {"lang": "en", "time": "2026-03-22T11:17:17.000Z", "value": "Disclosed"}], "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/8d954868-eff2-497d-84e7-cc42da8a4c6f?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/wp-google-map-plugin/tags/4.9.1/core/class.tabular.php#L780"}, {"url": "https://plugins.trac.wordpress.org/browser/wp-google-map-plugin/tags/4.9.1/classes/wpgmp-helper.php#L127"}, {"url": "https://plugins.trac.wordpress.org/browser/wp-google-map-plugin/tags/4.9.1/wp-google-map-plugin.php#L77"}], "descriptions": [{"lang": "en", "value": "The WP Maps \u2013 Store Locator,Google Maps,OpenStreetMap,Mapbox,Listing,Directory & Filters plugin for WordPress is vulnerable to time-based SQL Injection via the \u2018orderby\u2019 parameter in all versions up to, and including, 4.9.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-89", "description": "CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')"}]}], "providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-03-22T23:24:31.957Z"}}, "adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-2580", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-03-23T13:59:01.904424Z"}}}], "providerMetadata": {"shortName": "CISA-ADP", "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "dateUpdated": "2026-03-23T13:59:06.584Z"}}]}, "cveMetadata": {"cveId": "CVE-2026-2580", "state": "PUBLISHED", "dateUpdated": "2026-03-22T23:24:31.957Z", "dateReserved": "2026-02-16T10:43:01.261Z", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "datePublished": "2026-03-22T23:24:31.957Z", "assignerShortName": "Wordfence"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "WP Maps \u2013 Store Locator,Google Maps,OpenStreetMap,Mapbox,Listing,Directory & Filters", "vendor": "flippercode", "versions": [{"lessThanOrEqual": "4.9.1", "status": "affected", "version": "0", "versionType": "semver"}]}], "source": "security@wordfence.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "The WP Maps \u2013 Store Locator,Google Maps,OpenStreetMap,Mapbox,Listing,Directory & Filters plugin for WordPress is vulnerable to time-based SQL Injection via the \u2018orderby\u2019 parameter in all versions up to, and including, 4.9.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database."}, {"lang": "es", "value": "El plugin WP Maps \u2013 Store Locator,Google Maps,OpenStreetMap,Mapbox,Listing,Directory &amp; Filters para WordPress es vulnerable a inyecci\u00f3n SQL basada en tiempo a trav\u00e9s del par\u00e1metro 'orderby' en todas las versiones hasta la 4.9.1, inclusive, debido a un escape insuficiente en el par\u00e1metro proporcionado por el usuario y la falta de preparaci\u00f3n suficiente en la consulta SQL existente. Esto permite a atacantes no autenticados a\u00f1adir consultas SQL adicionales a consultas ya existentes que pueden utilizarse para extraer informaci\u00f3n sensible de la base de datos."}], "id": "CVE-2026-2580", "lastModified": "2026-06-17T10:31:21.040", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 3.6, "source": "security@wordfence.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-2580", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-03-23T13:59:01.904424Z", "version": "2.0.3"}}]}, "published": "2026-03-23T00:16:51.453", "references": [{"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/wp-google-map-plugin/tags/4.9.1/classes/wpgmp-helper.php#L127"}, {"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/wp-google-map-plugin/tags/4.9.1/core/class.tabular.php#L780"}, {"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/wp-google-map-plugin/tags/4.9.1/wp-google-map-plugin.php#L77"}, {"source": "security@wordfence.com", "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/8d954868-eff2-497d-84e7-cc42da8a4c6f?source=cve"}], "sourceIdentifier": "security@wordfence.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-89"}], "source": "security@wordfence.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,4.9.1]"}}], "enrichment": {"confidence": 95.0, "confidence_source": "inferred", "scores": [{"score": 95.0, "source": "inferred"}, {"score": 98.0, "source": "matching"}]}, "original": {"product": "WP Maps \u2013 Store Locator,Google Maps,OpenStreetMap,Mapbox,Listing,Directory & Filters", "source": "cna", "vendor": "flippercode"}, "product": "google_map", "vendor": "flippercode"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,4.9.1]"}}], "enrichment": {"confidence": 95.0, "confidence_source": "inferred", "scores": [{"score": 95.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "WP Maps \u2013 Store Locator,Google Maps,OpenStreetMap,Mapbox,Listing,Directory & Filters", "source": "cna", "vendor": "flippercode"}, "product": "wp_maps_\u2013_store_locator,google_maps,openstreetmap,mapbox,listing,directory_&_filters", "vendor": "flippercode"}, {"configurations": [{"platform": null, "status": "unaffected", "versions": null}], "enrichment": {"confidence": 80.0, "confidence_source": "inferred", "scores": [{"score": 80.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "product": "wordpress", "vendor": "wordpress"}], "analysis": {"en": {"generated_at": "2026-03-23T03:23:16.663139+00:00", "value": {"mitigation_remediation": ["Update the WP Maps plugin to the latest version that addresses the SQL injection flaw.", "If an update is not immediately available, disable or remove the plugin until a patch is released.", "Implement a web application firewall rule to block suspicious SQL injection attempts on the 'orderby' parameter.", "Regularly review database access logs for signs of unauthorized SELECT or UNION queries that might indicate exploitation."], "summary": {"action": "Immediate Patch", "impact": "SQL injection leading to unauthorized data exfiltration"}, "threat_synthesis": {"affected_systems": "The affected product is the WP Maps \u2013 Store Locator,Google Maps,OpenStreetMap,Mapbox,Listing,Directory & Filters plugin for WordPress, versions 4.9.1 and earlier. The plugin is maintained by FlipperCode. WordPress sites that have this plugin installed and did not upgrade beyond version 4.9.1 are vulnerable.", "description_and_impact": "The vulnerability occurs when the plugin processes the 'orderby' parameter without proper escaping, allowing an attacker to inject arbitrary SQL statements. This flaw enables unauthenticated users to append malicious code to existing queries and extract confidential data from the WordPress database. The weakness corresponds to CWE-89, a classic SQL injection weakness that impacts confidentiality and potentially integrity of stored data.", "risk_and_exploitability": "The CVSS base score is 7.5, indicating a high severity. Exploration of the vulnerability does not require prior authentication, implying that it can be exploited remotely by anyone who can send HTTP requests to the site. The EPSS score is not provided, and the vulnerability is not listed in the CISA KEV catalog, but the high severity combined with the lack of authentication requirement suggests a significant risk of exploitation if the plugin remains at a vulnerable version. An attacker would typically issue a crafted request containing a malicious SQL payload in the 'orderby' parameter of a plugin function."}}}}, "created": "2026-03-23T09:45:46.886402+00:00", "updated": "2026-03-25T14:50:20.718436+00:00", "vendors": ["flippercode", "flippercode$PRODUCT$google_map", "flippercode$PRODUCT$wp_maps_\u2013_store_locator,google_maps,openstreetmap,mapbox,listing,directory_&_filters", "wordpress", "wordpress$PRODUCT$wordpress"]}