Security readout for executives and security teams
Plain-English summary
Maps Marker Pro versions through 4.32 are reported vulnerable to unauthenticated SQL injection. An internet attacker may be able to manipulate database queries without logging in, potentially exposing sensitive information and disrupting service. The supplied CVSS score is 9.3, making rapid investigation appropriate for organizations running this WordPress plugin.
Executive priority
Treat this as an immediate inventory and remediation priority for internet-facing WordPress systems. Escalate confirmed installations through emergency vulnerability management because exploitation requires no account or user action and may expose database information. Urgency can be reduced only after confirming the plugin is absent, outside the reported range, unreachable, or remediated according to authoritative guidance.
Technical view
The reported CWE-89 flaw is remotely reachable with low attack complexity, requires neither privileges nor user interaction, and primarily threatens confidentiality, with limited availability impact. The supplied CVSS vector indicates changed scope and no integrity impact. The bundle does not identify the vulnerable parameter, endpoint, patch version, or root cause.
Likely exposure
Likely exposure is limited to reachable WordPress installations running Maps Marker Pro 4.32 or earlier. Confirm this locally: the bundle’s description names those versions, but its structured affected record lists versions as “n/a” and defaults to unaffected, creating an unresolved metadata conflict.
Exploitation context
The bundle does not establish active exploitation, and the CVE is not listed as KEV in the supplied data. It also provides no proof-of-concept details or observed attack reporting. Treat exploitation as plausible because the issue is unauthenticated and network-accessible, but do not represent it as observed in the wild.
Researcher notes
Evidence is incomplete. The description asserts Maps Marker Pro through 4.32 is affected, while the structured affected entry says “n/a” and defaults to unaffected. The bundle names no endpoint, parameter, patch, workaround, or exploitation telemetry. Researchers should reconcile the CVE record with the Patchstack and vendor advisories before making definitive version claims.
Mitigation direction
- Inventory all WordPress sites and identify installations of Maps Marker Pro.
- Prioritize internet-facing sites running version 4.32 or earlier for immediate review.
- Check current vendor and Patchstack guidance for an approved fixed version or mitigation.
- Consider disabling the plugin on exposed sites until authoritative remediation guidance is applied.
- Preserve relevant web, WAF, WordPress, and database logs before making changes.
Validation and detection
- Confirm the installed plugin version from trusted administrative or deployment records.
- Determine whether affected WordPress sites and plugin functionality are publicly reachable.
- Review web, WAF, application, and database logs for anomalous unauthenticated query activity.
- Validate remediation using non-destructive checks after following authoritative vendor guidance.
- Monitor the CVE and vendor advisory for clarified affected versions and fixes.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-89: Database access and collection lookup
Injection into data stores can inform collection, data access, and exfiltration detection reviews. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupDatabase behavior lookup
The CVE wording references database injection or access, so collection and exfiltration review may help. This is a Glexia inferred lookup path, not an official MITRE, ATT&CK, or CVE Program mapping.
Open ATT&CK lookupCVE-2026-73183 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Critical
- CVSS
- 9.3 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
SSVC decision data
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L3.94.7PatchstackVulnerability scoring details
Base CVSS 3.1 score
9.3CriticalVector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- https://patchstack.com/database/wordpress/plugin/maps-marker-pro/vulnerability/wordpress-maps-marker-pro-plugin-4-32-sql-injection-vulnerability?_s_id=cveCVE reference, Patchstack · vdb-entry
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Improper Neutralization of Special Elements used in an SQL Command
Improper Neutralization of Special Elements used in an SQL Command represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.