CVE-2026-3222

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-3222", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "state": "PUBLISHED", "assignerShortName": "Wordfence", "dateReserved": "2026-02-25T18:31:35.132Z", "datePublished": "2026-03-11T05:27:17.281Z", "dateUpdated": "2026-04-08T17:17:20.769Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T17:17:20.769Z"}, "affected": [{"vendor": "flippercode", "product": "WP Maps \u2013 Store Locator,Google Maps,OpenStreetMap,Mapbox,Listing,Directory & Filters", "versions": [{"version": "0", "status": "affected", "lessThanOrEqual": "4.9.1", "versionType": "semver"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "The WP Maps plugin for WordPress is vulnerable to time-based blind SQL Injection via the 'location_id' parameter in all versions up to, and including, 4.9.1. This is due to the plugin's database abstraction layer (`FlipperCode_Model_Base::is_column()`) treating user input wrapped in backticks as column names, bypassing the `esc_sql()` escaping function. Additionally, the `wpgmp_ajax_call` AJAX handler (registered for unauthenticated users via `wp_ajax_nopriv`) allows calling arbitrary class methods including `wpgmp_return_final_capability`, which passes the unsanitized `location_id` GET parameter directly to a database query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database."}], "title": "WP Maps <= 4.9.1 - Unauthenticated SQL Injection via 'location_id' Parameter", "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/b612267c-a125-4153-9de7-bb12a7646021?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/wp-google-map-plugin/tags/4.9.1/wp-google-map-plugin.php#L250"}, {"url": "https://plugins.trac.wordpress.org/browser/wp-google-map-plugin/trunk/wp-google-map-plugin.php#L250"}, {"url": "https://plugins.trac.wordpress.org/browser/wp-google-map-plugin/tags/4.9.1/wp-google-map-plugin.php#L590"}, {"url": "https://plugins.trac.wordpress.org/browser/wp-google-map-plugin/trunk/wp-google-map-plugin.php#L590"}, {"url": "https://plugins.trac.wordpress.org/browser/wp-google-map-plugin/tags/4.9.1/core/class.model.php#L328"}, {"url": "https://plugins.trac.wordpress.org/browser/wp-google-map-plugin/trunk/core/class.model.php#L328"}, {"url": "https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=3475665%40wp-google-map-plugin%2Ftrunk&old=3439153%40wp-google-map-plugin%2Ftrunk&sfp_email=&sfph_mail="}, {"url": "https://plugins.trac.wordpress.org/changeset/3475665/wp-google-map-plugin/trunk/wp-google-map-plugin.php"}, {"url": "https://plugins.trac.wordpress.org/changeset/3475665/wp-google-map-plugin/trunk/core/class.model.php"}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')", "cweId": "CWE-89", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "baseScore": 7.5, "baseSeverity": "HIGH"}}], "credits": [{"lang": "en", "type": "finder", "value": "JohSka"}], "timeline": [{"time": "2026-02-27T04:48:33.000Z", "lang": "en", "value": "Vendor Notified"}, {"time": "2026-03-10T17:22:45.000Z", "lang": "en", "value": "Disclosed"}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-03-11T14:06:05.779989Z", "id": "CVE-2026-3222", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-11T14:06:44.795Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-3222", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-03-11T14:06:05.779989Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-11T14:06:10.663Z"}}], "cna": {"title": "WP Maps <= 4.9.1 - Unauthenticated SQL Injection via 'location_id' Parameter", "credits": [{"lang": "en", "type": "finder", "value": "JohSka"}], "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 7.5, "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"}}], "affected": [{"vendor": "flippercode", "product": "WP Maps \u2013 Store Locator,Google Maps,OpenStreetMap,Mapbox,Listing,Directory & Filters", "versions": [{"status": "affected", "version": "0", "versionType": "semver", "lessThanOrEqual": "4.9.1"}], "defaultStatus": "unaffected"}], "timeline": [{"lang": "en", "time": "2026-02-27T04:48:33.000Z", "value": "Vendor Notified"}, {"lang": "en", "time": "2026-03-10T17:22:45.000Z", "value": "Disclosed"}], "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/b612267c-a125-4153-9de7-bb12a7646021?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/wp-google-map-plugin/tags/4.9.1/wp-google-map-plugin.php#L250"}, {"url": "https://plugins.trac.wordpress.org/browser/wp-google-map-plugin/trunk/wp-google-map-plugin.php#L250"}, {"url": "https://plugins.trac.wordpress.org/browser/wp-google-map-plugin/tags/4.9.1/wp-google-map-plugin.php#L590"}, {"url": "https://plugins.trac.wordpress.org/browser/wp-google-map-plugin/trunk/wp-google-map-plugin.php#L590"}, {"url": "https://plugins.trac.wordpress.org/browser/wp-google-map-plugin/tags/4.9.1/core/class.model.php#L328"}, {"url": "https://plugins.trac.wordpress.org/browser/wp-google-map-plugin/trunk/core/class.model.php#L328"}, {"url": "https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=3475665%40wp-google-map-plugin%2Ftrunk&old=3439153%40wp-google-map-plugin%2Ftrunk&sfp_email=&sfph_mail="}, {"url": "https://plugins.trac.wordpress.org/changeset/3475665/wp-google-map-plugin/trunk/wp-google-map-plugin.php"}, {"url": "https://plugins.trac.wordpress.org/changeset/3475665/wp-google-map-plugin/trunk/core/class.model.php"}], "descriptions": [{"lang": "en", "value": "The WP Maps plugin for WordPress is vulnerable to time-based blind SQL Injection via the 'location_id' parameter in all versions up to, and including, 4.9.1. This is due to the plugin's database abstraction layer (`FlipperCode_Model_Base::is_column()`) treating user input wrapped in backticks as column names, bypassing the `esc_sql()` escaping function. Additionally, the `wpgmp_ajax_call` AJAX handler (registered for unauthenticated users via `wp_ajax_nopriv`) allows calling arbitrary class methods including `wpgmp_return_final_capability`, which passes the unsanitized `location_id` GET parameter directly to a database query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-89", "description": "CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')"}]}], "providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T17:17:20.769Z"}}}, "cveMetadata": {"cveId": "CVE-2026-3222", "state": "PUBLISHED", "dateUpdated": "2026-04-08T17:17:20.769Z", "dateReserved": "2026-02-25T18:31:35.132Z", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "datePublished": "2026-03-11T05:27:17.281Z", "assignerShortName": "Wordfence"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "WP Maps \u2013 Store Locator,Google Maps,OpenStreetMap,Mapbox,Listing,Directory & Filters", "vendor": "flippercode", "versions": [{"lessThanOrEqual": "4.9.1", "status": "affected", "version": "0", "versionType": "semver"}]}], "source": "security@wordfence.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "The WP Maps plugin for WordPress is vulnerable to time-based blind SQL Injection via the 'location_id' parameter in all versions up to, and including, 4.9.1. This is due to the plugin's database abstraction layer (`FlipperCode_Model_Base::is_column()`) treating user input wrapped in backticks as column names, bypassing the `esc_sql()` escaping function. Additionally, the `wpgmp_ajax_call` AJAX handler (registered for unauthenticated users via `wp_ajax_nopriv`) allows calling arbitrary class methods including `wpgmp_return_final_capability`, which passes the unsanitized `location_id` GET parameter directly to a database query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database."}, {"lang": "es", "value": "El plugin WP Maps para WordPress es vulnerable a inyecci\u00f3n SQL ciega basada en tiempo a trav\u00e9s del par\u00e1metro 'location_id' en todas las versiones hasta, e incluyendo, la 4.9.1. Esto se debe a que la capa de abstracci\u00f3n de base de datos del plugin (`FlipperCode_Model_Base::is_column()`) trata la entrada del usuario envuelta en comillas invertidas como nombres de columna, omitiendo la funci\u00f3n de escape `esc_sql()`. Adem\u00e1s, el gestor AJAX `wpgmp_ajax_call` (registrado para usuarios no autenticados a trav\u00e9s de `wp_ajax_nopriv`) permite llamar a m\u00e9todos de clase arbitrarios, incluyendo `wpgmp_return_final_capability`, que pasa el par\u00e1metro GET `location_id` sin sanitizar directamente a una consulta de base de datos. Esto hace posible que atacantes no autenticados a\u00f1adan consultas SQL adicionales a consultas ya existentes que pueden ser usadas para extraer informaci\u00f3n sensible de la base de datos."}], "id": "CVE-2026-3222", "lastModified": "2026-06-17T10:43:14.623", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 3.6, "source": "security@wordfence.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-3222", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-03-11T14:06:05.779989Z", "version": "2.0.3"}}]}, "published": "2026-03-11T06:17:14.777", "references": [{"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/wp-google-map-plugin/tags/4.9.1/core/class.model.php#L328"}, {"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/wp-google-map-plugin/tags/4.9.1/wp-google-map-plugin.php#L250"}, {"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/wp-google-map-plugin/tags/4.9.1/wp-google-map-plugin.php#L590"}, {"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/wp-google-map-plugin/trunk/core/class.model.php#L328"}, {"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/wp-google-map-plugin/trunk/wp-google-map-plugin.php#L250"}, {"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/wp-google-map-plugin/trunk/wp-google-map-plugin.php#L590"}, {"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/changeset/3475665/wp-google-map-plugin/trunk/core/class.model.php"}, {"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/changeset/3475665/wp-google-map-plugin/trunk/wp-google-map-plugin.php"}, {"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=3475665%40wp-google-map-plugin%2Ftrunk&old=3439153%40wp-google-map-plugin%2Ftrunk&sfp_email=&sfph_mail="}, {"source": "security@wordfence.com", "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/b612267c-a125-4153-9de7-bb12a7646021?source=cve"}], "sourceIdentifier": "security@wordfence.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-89"}], "source": "security@wordfence.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,4.9.1]"}}], "enrichment": {"confidence": 95.0, "confidence_source": "inferred", "scores": [{"score": 95.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "WP Maps \u2013 Store Locator,Google Maps,OpenStreetMap,Mapbox,Listing,Directory & Filters", "source": "cna", "vendor": "flippercode"}, "product": "wp_maps_\u2013_store_locator,google_maps,openstreetmap,mapbox,listing,directory_&_filters", "vendor": "flippercode"}, {"configurations": [{"platform": null, "status": "unaffected", "versions": null}], "enrichment": {"confidence": 80.0, "confidence_source": "inferred", "scores": [{"score": 80.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "product": "wordpress", "vendor": "wordpress"}], "analysis": {"en": {"generated_at": "2026-03-17T17:25:00.848479+00:00", "value": {"mitigation_remediation": ["Check the vendor\u2019s website or the WordPress plugin repository for an updated version of WP Maps that removes the vulnerable code.", "If an update is not available, disable or restrict access to the 'wpgmp_ajax_call' AJAX endpoint so that only authenticated users can invoke it.", "Limit the privileges of the database user used by WordPress to the minimum required for normal operation.", "Monitor database and web server logs for unusual queries or failed login attempts that involve the 'location_id' parameter.", "Apply general WordPress hardening measures, such as keeping all core files, themes, and plugins up to date, using a web application firewall to block SQL injection patterns, and restricting plugin installation to approved developers."], "summary": {"action": "Patch", "impact": "SQL Injection (Data Compromise)"}, "threat_synthesis": {"affected_systems": "Affected are installations of FlipperCode\u2019s WP Maps \u2013 Store Locator plugin and its components (Google Maps, OpenStreetMap, Mapbox, Listing, Directory & Filters) running any version up to and including 4.9.1. The vulnerability is present in core files such as class.model.php and wp-google-map-plugin.php as shown in the provided references.", "description_and_impact": "Key detail from description: the WP Maps plugin for WordPress is vulnerable to time\u2011based blind SQL injection via the 'location_id' parameter in all versions up to and including 4.9.1. The flaw allows an unauthenticated attacker to inject additional SQL into existing queries, potentially extracting sensitive database contents. This is a direct instance of CWE-89 because it involves unsanitized user input being passed to a database query.", "risk_and_exploitability": "The CVSS score of 7.5 indicates a high severity, while the EPSS score of less than 1\u202f% suggests a relatively low likelihood of widespread exploitation at present. The vulnerability can be triggered without authentication through the 'wpgmp_ajax_call' AJAX endpoint, meaning an attacker can send crafted requests from any IP. Because the vulnerability allows extraction of proprietary data, it poses a significant threat to confidentiality and integrity of the WordPress database. The plugin is not listed in the CISA KEV catalog, so there are no known large\u2011scale exploits for this flaw yet, but its ease of exploitation warrants prompt mitigation."}}}}, "created": "2026-03-11T11:37:53.214562+00:00", "updated": "2026-03-20T14:37:50.952057+00:00", "vendors": ["flippercode", "flippercode$PRODUCT$wp_maps_\u2013_store_locator,google_maps,openstreetmap,mapbox,listing,directory_&_filters", "wordpress", "wordpress$PRODUCT$wordpress"]}