CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:L
What the vulnerability does
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in pankajpragma WordPress Google Map Professional google-map-professional allows SQL Injection.This issue affects WordPress Google Map Professional: from n/a through <= 1.0.
Explanation of Vulnerability in Simple Terms
The WordPress Google Map Professional plugin versions 1.0 and earlier contains a SQL injection vulnerability in database queries. An attacker with low-level WordPress access can craft malicious input to execute arbitrary SQL commands, potentially reading sensitive data from the database or disrupting site availability. The vulnerability affects multiple database operations and requires only basic user privileges to exploit.
What an attacker can do
Read sensitive data from the site database or cause the database to become unavailable.
Potential impact on your site
Attackers with basic WordPress accounts can steal database contents or crash the site's database functionality.
Conditions required to exploit
Attacker must have a low-privilege WordPress user account (subscriber or higher).
Key dates
External resources
Related vulnerabilities
