Vulnerability · Published May 9, 2022 · Assigned by WPScan
CVE-2022-0592MapSVG < 6.2.20 - Unauthenticated SQLi
Critical 9.8
In plain English
A critical-severity SQL injection in MapSVG from Unknown. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 10.2% (higher than 96% of all known vulnerabilities). Ready-made attack tooling exists: Nuclei.
Severity (CVSS NVD)9.8Critical
Exploit odds (30 days)10.2%top 4.3% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack tooling1Nuclei
Official description
The MapSVG WordPress plugin before 6.2.20 does not validate and escape a parameter via a REST endpoint before using it in a SQL statement, leading to a SQL Injection exploitable by unauthenticated users.
Affected products (as reported)
Weakness: CWE-89