CVE-2019-10692

CRITICAL NUCLEI

WP Go Maps < 7.11.18 - SQL Injection via REST API Field Name

Title source: llm
STIX 2.1

Exploitation Summary

EIP tracks 1 public exploit for CVE-2019-10692. PoCs published by Thomas Chauchefoin (Synacktiv), including Metasploit module auxiliary/admin/http/wp_google_maps_sqli. A Nuclei detection template is also available.

AI-analyzed exploit summary This Metasploit module exploits a SQL injection vulnerability in the WordPress Google Maps plugin (versions 7.11.00 to 7.11.17) via a REST endpoint. It retrieves user credentials from the database and stores them as loot.

Description

In the wp-google-maps plugin before 7.11.18 for WordPress, includes/class.rest-api.php in the REST API does not sanitize field names before a SELECT statement.

Exploits (1)

metasploit WORKING POC
by Thomas Chauchefoin (Synacktiv) · rubypoc
https://github.com/rapid7/metasploit-framework/blob/master/modules/auxiliary/admin/http/wp_google_maps_sqli.rb

This Metasploit module exploits a SQL injection vulnerability in the WordPress Google Maps plugin (versions 7.11.00 to 7.11.17) via a REST endpoint. It retrieves user credentials from the database and stores them as loot.

Classification
Working Poc 95%
Attack Type
Sqli
Complexity
Trivial
Reliability
Reliable
Target: WordPress Google Maps plugin 7.11.00 to 7.11.17
No auth needed
Prerequisites: WordPress installation with vulnerable plugin · Network access to the target
devstral-2 · analyzed Feb 16, 2026 Full analysis →

Nuclei Templates (1)

WordPress Google Maps <7.11.18 - SQL Injection
CRITICALVERIFIEDby pussycat0x

References (4)

Core 4

Scores

CVSS v3 9.8
EPSS 0.8876
EPSS Percentile 99.5%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Details

CWE
CWE-89
Status published
Products (1)
codecabin/wp_go_maps < 7.11.18
Published Apr 02, 2019
Tracked Since Feb 18, 2026