Vulnerability · Published Mar 13, 2023 · Assigned by WPScan
CVE-2023-003710WebMapBuilder < 1.0.73 - Unauthenticated SQLi
Critical 9.8
In plain English
A critical-severity security flaw in 10Web Map Builder for Google Maps from Unknown. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 3.9% (higher than 90% of all known vulnerabilities). Ready-made attack tooling exists: Nuclei.
Severity (CVSS 3.1)9.8Critical
Exploit odds (30 days)3.9%top 9.7% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack tooling1Nuclei
Official description
The 10Web Map Builder for Google Maps WordPress plugin before 1.0.73 does not properly sanitise and escape some parameters before using them in an SQL statement via an AJAX action available to unauthenticated users, leading to a SQL injection
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Unknown | 10Web Map Builder for Google Maps | 0 – before 1.0.73 |
References
- https://wpscan.com/vulnerability/33ab1fe2-6611-4f43-91ba-52c56f02ed56 exploit, vdb-entry, technical-description
- https://bulletin.iese.de/post/wd-google-maps_1-0-72_1