An unauthenticated SQL injection vulnerability in the RomanCode MapSVG plugin poses a critical risk of unauthorized database access and potential data exfiltration.

This vulnerability is a classic SQL injection flaw occurring in the MapSVG plugin. Because the vulnerability does not require authentication, any remote attacker can submit malicious inputs to the application to manipulate backend database queries.

Successful exploitation of this vulnerability allows an attacker to bypass security controls and gain unauthorized access to sensitive data stored within the WordPress database. Given the CVSS score of 9.3, this flaw is categorized as critical: it presents a high potential for data breaches and loss of confidentiality, which could result in severe reputational damage and regulatory non-compliance.

Immediate Action: Update the MapSVG plugin to version 8.14.1 or later immediately to apply the vendor-provided patch.

Proactive Monitoring: Review database query logs for unusual patterns, such as unexpected syntax errors or suspicious SQL keywords originating from public-facing web requests.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to detect and block common SQL injection patterns until the plugin can be patched.

Public Exploit Available: No (exploit_available: false)

The critical severity of this vulnerability necessitates immediate remediation. Organizations using the MapSVG plugin must prioritize updating to version 8.14.1 or higher to eliminate this attack vector. Failure to patch leaves the underlying database exposed to unauthorized access by any remote attacker.