https://exploit-intel.com/blog/tags/cwe-89/EIP research articles tagged cwe-89.en-usSun, 29 Mar 2026 00:00:00 -0400https://exploit-intel.com/blog/posts/wp-google-map-plugin/https://exploit-intel.com/blog/posts/wp-google-map-plugin/Line 781 says $query_to_run is safe. It isn't. An autonomous pipeline found a CVSS 9.8 unauthenticated SQL injection in WP Google Map Plugin v4.9.1 -- a three-link chain of individually harmless components that, together, give any visitor full database access. Then we kept reading and found the plugin deserializes update-check responses from an external server with maybe_unserialize(). 200,000+ active installs. 35 minutes. $8.97.Sun, 29 Mar 2026 00:00:00 -0400