CVE-2026-15381 PUBLISHED

WP Go Maps < 10.1.04 - Unauthenticated SQL Injection via Markers REST filter

Assigner: WPScan
Reserved: 10.07.2026 Published: 31.07.2026 Updated: 31.07.2026

The WP Go Maps WordPress plugin before 10.1.04 does not properly sanitise and escape a parameter before using it in a SQL query, allowing unauthenticated users to perform SQL injection attacks.

Product Status

Vendor Unknown
Product WP Go Maps
Versions Default: unaffected
  • affected from 0 to 10.1.04 (excl.)

Credits

  • Jakub Herman finder
  • WPScan coordinator

References

Problem Types

  • CWE-89 SQL Injection CWE