The WordPress 10Web Map Builder plugin is a popular tool for integrating Google Maps into WordPress sites, used by bloggers, businesses, and developers to display custom maps with markers, directions, and layers. It simplifies map creation through a visual editor, making geographical data accessible without coding. Site administrators rely on it for interactive features that boost user engagement and provide location-based services.
This SQL Injection vulnerability arises from improper sanitization of user-supplied input passed to SQL queries. The plugin fails to validate or escape data before using it in database operations, allowing attackers to inject malicious SQL commands. This flaw is common in legacy code where input validation is overlooked, especially in AJAX handlers that process requests without authentication checks.
The vulnerable endpoint is the AJAX action 'wpmap_builder_ajax', specifically the 'id' parameter used in a GET request. An unauthenticated attacker can send a crafted request with SQL payloads in the 'id' field, which is directly concatenated into a query without parameterization. This allows manipulation of the database query structure, enabling data extraction or modification.
Exploitation can lead to full database compromise, including theft of user credentials, session tokens, and sensitive site data. With a CVSS score of 9.8, this critical vulnerability can be chained with other attacks to achieve remote code execution or complete site takeover, severely impacting confidentiality, integrity, and availability.
- Update the WordPress 10Web Map Builder plugin to version 1.0.73 or later immediately.
- Implement input validation and sanitization for all user inputs in the plugin codebase, especially in AJAX handlers.
- Use parameterized queries (prepared statements) for all database interactions to prevent SQL injection.
- Apply a Web Application Firewall (WAF) with rules to block SQL injection patterns.
- Conduct regular security audits and penetration testing on WordPress plugins.
- Disable unused AJAX actions or restrict them to authenticated users only.
- Monitor database logs for suspicious queries and unauthorized access attempts.
- Enforce least privilege for database user accounts used by the plugin.
Get AI-powered remediation steps tailored to your asset.
Try AI Solutions →