CVE-2026-66618: WordPress WP Maps plugin <= 4.9.9 - SQL Injection vulnerability
Published Sep 17, 2026
·Updated
Administrator SQL Injection in WP Maps <= 4.9.9 versions.
Affected Software
1 affected component
WordPress WP MAPS<=4.9.9
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
WordPress WP Maps pluginto a version that resolves this vulnerability.Fixed in 5.0.0
Event History
Sep 17, 2026
CVE Published
via MITRE·01:24 PM
Data Sourced
via MITRE·01:24 PM
RemedyDescriptionSeverityWeakness
Frequently Asked Questions
1
Who needs to be able to exploit this issue?
The vulnerability requires administrator-level privileges. The attack vector is network-based and does not require user interaction.
2
Which installations should be treated as affected?
WP Maps versions 4.9.9 and earlier are identified as affected. Check the installed WP Maps plugin version to determine whether an installation falls within this range.
3
What impact is indicated if exploitation succeeds?
The provided severity vector indicates high confidentiality impact and low availability impact. Integrity impact is listed as none, while the scope is changed.