CVE-2026-111399: WordPress MapSVG plugin <= 8.16.1 - SQL Injection vulnerability

Q: What level of access does an attacker need to exploit this issue?

The vulnerability is remotely exploitable with low attack complexity, but the attacker must have low-level privileges. No user interaction is required.

Q: What is the potential impact if exploitation succeeds?

Successful exploitation can expose highly sensitive information and can cause a limited availability impact. The vulnerability is rated high severity with a CVSS score of 8.5 and has changed scope.

Q: Which MapSVG versions are affected?

MapSVG versions through 8.16.1 are affected. The affected version range begins at an unspecified earlier version.

Published Oct 16, 2026

Updated

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in PT Norther Lights Production MapSVG mapsvg-lite-interactive-vector-maps allows SQL Injection.This issue affects MapSVG: from n/a through 8.16.1.

Affected Software

1 affected component

PT Northern Lights Production MapSVG<=8.16.1

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade WordPress MapSVG plugin to a version that resolves this vulnerability.
Fixed in 8.16.2

Event History

Oct 16, 2026

CVE Published

via MITRE·12:30 PM

Data Sourced

via MITRE·12:30 PM

RemedyDescriptionSeverityWeakness

Frequently Asked Questions

What level of access does an attacker need to exploit this issue?

The vulnerability is remotely exploitable with low attack complexity, but the attacker must have low-level privileges. No user interaction is required.

What is the potential impact if exploitation succeeds?