CVE-2026-39492

🗓️ 15 Jun 2026 20:17:53Reported by PatchstackType

cve🔗 web.nvd.nist.gov👁 14 Views🌐 WEB

CVE-2026-39492: WP Maps plugin up to 4.9.1 has unauthenticated SQL injection.

Reporter	Title	Published	Views	Family All 8
GithubExploit	Exploit for CVE-2026-39492	7 Jul 202612:28	–	githubexploit
Circl	CVE-2026-39492	13 Jul 202622:00	–	circl
Cvelist	CVE-2026-39492 WordPress WP Maps plugin <= 4.9.1 - SQL Injection vulnerability	15 Jun 202620:17	–	cvelist
EUVD	EUVD-2026-36943	15 Jun 202621:30	–	euvd
NVD	CVE-2026-39492	15 Jun 202621:16	–	nvd
Patchstack	WordPress WP Maps plugin <= 4.9.1 - SQL Injection vulnerability	8 Apr 202610:54	–	patchstack
Positive Technologies	PT-2026-49384	15 Jun 202600:00	–	ptsecurity
Vulnrichment	CVE-2026-39492 WordPress WP Maps plugin <= 4.9.1 - SQL Injection vulnerability	15 Jun 202620:17	–	vulnrichment

Vulners

Node

flipper_code_wordpress_development_company wp_mapsRange≤4.9.1wordpress

[
  {
    "vendor": "Flipper Code – WordPress Development Company",
    "collectionURL": "https://wordpress.org/plugins",
    "defaultStatus": "unaffected",
    "packageName": "wp-google-map-plugin",
    "product": "WP Maps",
    "versions": [
      {
        "lessThanOrEqual": "4.9.1",
        "status": "affected",
        "version": "n/a",
        "versionType": "custom",
        "changes": [
          {
            "at": "4.9.2",
            "status": "unaffected"
          }
        ]
      }
    ]
  }
]

Source	Link
patchstack	www.patchstack.com/database/wordpress/plugin/wp-google-map-plugin/vulnerability/wordpress-wp-maps-plugin-4-9-1-sql-injection-vulnerability

Parameter	Position	Path	Description	CWE
location_id	request body	wp-admin/admin-ajax.php	Pre-auth blind SQL injection via backtick bypass in WP Maps wpgmp_ajax_call (location_id) in unauthenticated context	CWE-89

17 Jun 2026 10:42Current

5.7Medium risk

Vulners AI Score5.7

CVSS 3.19.3

EPSS0.00363

SSVC

CWE-89