CVE-2026-2580
Published: 23 March 2026
Summary
CVE-2026-2580 is a high-severity SQL Injection (CWE-89) vulnerability in Wordpress (inferred from references). Its CVSS base score is 7.5 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 28.3th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).
Deeper analysis
CVE-2026-2580 is a time-based SQL injection vulnerability (CWE-89) in the WP Maps – Store Locator, Google Maps, OpenStreetMap, Mapbox, Listing, Directory & Filters plugin for WordPress. It affects all versions up to and including 4.9.1 and stems from insufficient escaping of the user-supplied 'orderby' parameter combined with inadequate preparation of the existing SQL query. Published on 2026-03-23, the vulnerability carries a CVSS v3.1 base score of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N), highlighting its potential for high confidentiality impact over the network.
Unauthenticated attackers can exploit the vulnerability remotely with low complexity and no user interaction required. By injecting payloads via the 'orderby' parameter, they can append malicious SQL queries to legitimate ones, leveraging time-based blind SQL injection to extract sensitive information from the database.
References include source code excerpts from the plugin's trac repository, pinpointing the issue at wpgmp-helper.php line 127, class.tabular.php line 780, and wp-google-map-plugin.php line 77. Further details on the vulnerability are provided in Wordfence's threat intelligence report.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-14335
Vulnerability details
The WP Maps – Store Locator,Google Maps,OpenStreetMap,Mapbox,Listing,Directory & Filters plugin for WordPress is vulnerable to time-based SQL Injection via the ‘orderby’ parameter in all versions up to, and including, 4.9.1 due to insufficient escaping on the user supplied parameter and…
more
lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Remote unauthenticated SQL injection in a public-facing WordPress plugin directly enables T1190 for initial access and database information extraction.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly mitigates the SQL injection vulnerability by requiring validation and sanitization of user-supplied 'orderby' parameters before incorporation into SQL queries.
Requires identification, reporting, and correction of the specific SQL injection flaw in the WP Maps plugin, enabling timely patching to version beyond 4.9.1.
Boundary protection at web interfaces, such as web application firewalls, inspects and blocks malicious SQL injection payloads in the 'orderby' parameter.