CVE-2026-3222

The WP Maps plugin for WordPress is vulnerable to time-based blind SQL Injection via the 'location_id' parameter in all versions up to, and including, 4.9.1. This is due to the plugin's database abstraction layer (`FlipperCode_Model_Base::is_column()`) treating user input wrapped in backticks as column names, bypassing the `esc_sql()` escaping function. Additionally, the `wpgmp_ajax_call` AJAX handler (registered for unauthenticated users via `wp_ajax_nopriv`) allows calling arbitrary class methods including `wpgmp_return_final_capability`, which passes the unsanitized `location_id` GET parameter directly to a database query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.

• CWE-89

• https://plugins.trac.wordpress.org/browser/wp-google-map-plugin/tags/4.9.1/core/class.model.php#L328
• https://plugins.trac.wordpress.org/browser/wp-google-map-plugin/tags/4.9.1/wp-google-map-plugin.php#L250
• https://plugins.trac.wordpress.org/browser/wp-google-map-plugin/tags/4.9.1/wp-google-map-plugin.php#L590
• https://plugins.trac.wordpress.org/browser/wp-google-map-plugin/trunk/core/class.model.php#L328
• https://plugins.trac.wordpress.org/browser/wp-google-map-plugin/trunk/wp-google-map-plugin.php#L250
• https://plugins.trac.wordpress.org/browser/wp-google-map-plugin/trunk/wp-google-map-plugin.php#L590
• https://plugins.trac.wordpress.org/changeset/3475665/wp-google-map-plugin/trunk/core/class.model.php
• https://plugins.trac.wordpress.org/changeset/3475665/wp-google-map-plugin/trunk/wp-google-map-plugin.php
• https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=3475665%40wp-google-map-plugin%2Ftrunk&old=3439153%40wp-google-map-plugin%2Ftrunk&sfp_email=&sfph_mail=
• https://www.wordfence.com/threat-intel/vulnerabilities/id/b612267c-a125-4153-9de7-bb12a7646021?source=cve

Published

Mar 11, 2026

Last Modified

Jun 17, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-32214Improper access control in Universal Plug and Play (upnp.dll…5.5
• CVE-2026-32215Insertion of sensitive information into log file in Windows …5.5
• CVE-2026-32216Null pointer dereference in Windows Redirected Drive Bufferi…5.5
• CVE-2026-32217Insertion of sensitive information into log file in Windows …5.5
• CVE-2026-32218Insertion of sensitive information into log file in Windows …5.5
• CVE-2026-32219Double free in Microsoft Brokering File System allows an aut…7
• CVE-2026-32220Improper access control in Windows Virtualization-Based Secu…4.4
• CVE-2026-32221Heap-based buffer overflow in Microsoft Graphics Component a…8.4
• CVE-2026-32222Untrusted pointer dereference in Windows Win32K - ICOMP allo…7.8
• CVE-2026-32223Heap-based buffer overflow in Windows USB Print Driver allow…6.8
• CVE-2026-32224Use after free in Windows Server Update Service allows an au…7
• CVE-2026-32225Protection mechanism failure in Windows Shell allows an unau…8.8