An authenticated SQL injection vulnerability in the MapSVG plugin exposes site databases to unauthorized query execution by contributors.

This vulnerability is a SQL injection flaw, CWE-89, occurring because the plugin fails to properly validate input during database operations. The vulnerability is accessible to authenticated users with contributor roles.

Successful exploitation could result in unauthorized access to sensitive database information, potentially compromising user data and site configuration. With a CVSS score of 8.5, this high severity flaw warrants immediate attention to prevent potential data breaches or unauthorized administrative actions.

Immediate Action: Update the MapSVG plugin to version 8.14.1 or later immediately to resolve the vulnerability.

Proactive Monitoring: Review security logs for anomalous database activity and monitor for any suspicious queries linked to contributor-level user accounts.

Compensating Controls: Implement a Web Application Firewall to filter out malicious SQL injection attempts until the update can be fully deployed.

Public Exploit Available: Unknown.

This vulnerability presents a high risk to the integrity and confidentiality of the WordPress environment. Administrators must move quickly to update the MapSVG plugin to version 8.14.1 to neutralize the threat posed by this SQL injection flaw.