The MapSVG plugin for WordPress is vulnerable to an unauthenticated SQL injection flaw, which poses a critical risk of unauthorized database access.

This vulnerability is an improper neutralization of special elements used in an SQL command (CWE-89). It allows unauthenticated remote attackers to inject malicious SQL queries into the application database.

The ability for an unauthenticated actor to execute arbitrary SQL commands presents a severe risk to data confidentiality and integrity. With a CVSS score of 9.3, this vulnerability could be leveraged to extract sensitive information from the underlying WordPress database, potentially leading to a complete compromise of the site or exposure of user data.

Immediate Action: Update the MapSVG plugin to version 8.14.1 or the latest available version immediately.

Proactive Monitoring: Review database error logs for unusual query patterns and monitor access logs for suspicious requests targeting the plugin.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to detect and block common SQL injection patterns.

Public Exploit Available: Unknown

Given the critical nature of this SQL injection vulnerability and the high CVSS score, immediate patching is required. Administrators should prioritize upgrading to version 8.14.1 to eliminate the risk of unauthorized database access and potential data exfiltration.