CVE-2022-0592
Published: 09 May 2022
Summary
CVE-2022-0592 is a critical-severity SQL Injection (CWE-89) vulnerability in Mapsvg Mapsvg. Its CVSS base score is 9.8 (Critical).
Operationally, ranked in the top 1.3% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
Deeper analysis
The MapSVG WordPress plugin before version 6.2.20 contains a SQL injection vulnerability (CWE-89) because it fails to validate or escape a parameter passed to a REST endpoint before incorporating the value into a SQL statement. The affected component is the MapSVG plugin running on WordPress sites, and the flaw carries a CVSS 3.1 score of 9.8.
Unauthenticated attackers can send crafted requests to the exposed REST endpoint to inject arbitrary SQL, enabling them to read, modify, or delete database contents and potentially achieve full control over the WordPress site and its data.
Public advisories published by WPScan on 9 May 2022 identify the issue and confirm that updating to MapSVG 6.2.20 or later closes the injection vector by adding proper sanitization.
The EPSS score for this CVE stands at 0.6987 with no subsequent increase, indicating sustained but not newly emerging exploitation interest after disclosure.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2022-15699
Vulnerability details
The MapSVG WordPress plugin before 6.2.20 does not validate and escape a parameter via a REST endpoint before using it in a SQL statement, leading to a SQL Injection exploitable by unauthenticated users.
- CWE(s)
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
Likely Mitigating Controls AI
Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.