CVE-2019-10692: WordPress wp-google-maps plugin REST API SQL injection

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 18 September 2026. Confidence: high.

critical priorityCVSS 9.8 with unauthenticated network exploitation and very high EPSS (0.787) make this an urgent patch-first issue.

What it is

The wp-google-maps plugin before 7.11.18 fails to sanitize field names used in a SELECT statement within includes/class.rest-api.php. This allows SQL injection through the plugin's REST API. Given the plugin's wide install base and the unauthenticated network vector, it is a serious risk to WordPress sites running the affected version.

Impact

An attacker can inject arbitrary SQL into the plugin's database queries, potentially reading, modifying, or deleting data in the WordPress database. With the CVSS vector indicating high confidentiality, integrity, and availability impact, full compromise of the site's data is possible.

Attack surface

The flaw is reachable over the network via the plugin's REST API endpoint; the CVSS vector shows no privileges required and no user interaction, so it is unauthenticated. No specific endpoint path is given in the record.

Exploitation

The record lists exploit references (Packet Storm, Rapid7 module) but is not in CISA KEV and has no ransomware association; EPSS is very high at 0.787 (99.6th percentile), indicating likely active exploitation.

What to do

• Update the wp-google-maps plugin to version 7.11.18 or later immediately.
• If patching is not possible, disable or remove the plugin until it can be updated.
• Restrict access to the WordPress REST API where feasible (e.g., via WAF rules or authentication) to reduce exposure.
• Monitor database and web logs for SQL injection attempts against the plugin's REST endpoints.
• Apply virtual patching through a WAF if available, focusing on SQLi patterns in REST API requests.

Detection

• Inspect web server and WAF logs for SQL injection patterns (e.g., UNION, SELECT, sleep) in requests to wp-google-maps REST API routes.
• Monitor database queries for anomalous SELECT statements originating from the plugin's REST API code path.
• Use the Rapid7 auxiliary module or similar tooling in a controlled environment to validate exposure, then check logs for matching activity.
• Review WordPress audit logs for unexpected changes to plugin settings or database content.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.