A critical SQL injection vulnerability in the Supsystic Ultimate Maps plugin enables unauthenticated attackers to perform unauthorized database operations.

The plugin fails to properly sanitize input, leading to an SQL injection (CWE-89) vulnerability. An unauthenticated remote attacker can leverage this flaw to execute arbitrary SQL commands.

With a CVSS score of 8.2, this vulnerability presents a high risk to the confidentiality of the WordPress database. An attacker could potentially extract administrative information or sensitive user data, leading to a complete breach of the application's backend data store.

Immediate Action: Disable or remove the Supsystic Ultimate Maps plugin immediately until the vendor provides a secure, patched version.

Proactive Monitoring: Monitor server logs for suspicious database activity and SQL-related error messages that may indicate an ongoing exploitation attempt.

Compensating Controls: Utilize a Web Application Firewall (WAF) to filter incoming requests and block malicious SQL injection strings targeting the plugin.

Public Exploit Available: Yes — a public exploit is available via ExploitDB (ID 49532).

The presence of a public exploit significantly increases the risk profile of this vulnerability. Organizations using this plugin should take immediate steps to isolate or remove the software to mitigate the threat of unauthorized data access.