Critical SQL Injection in Maps Marker Pro WordPress Plugin (CVE-2026-73183)

Executive Summary

A critical unauthenticated SQL injection vulnerability has been disclosed in Maps Marker Pro, a popular WordPress mapping and location plugin. Tracked as CVE-2026-73183 with a CVSS score of 9.3, the flaw affects all versions up to and including 4.32. An unauthenticated attacker can exploit this to read, modify, or exfiltrate the entire WordPress database — including user credentials, private content, and configuration data — with no login required.

Vulnerability Overview

Affected Versions

SQL Injection Impact

SQL injection vulnerabilities at this severity level can be chained through multiple attack stages:

1. Attacker locates WordPress site running Maps Marker Pro <= 4.32
2. Attacker crafts a malicious SQL payload in an unauthenticated request
3. Plugin fails to properly sanitize or parameterize user input
4. Attacker extracts wp_users table — usernames, emails, hashed passwords
5. Attacker may write or modify database records (depending on DB user privileges)
6. Offline password cracking of extracted hashes leads to admin account takeover

Potential Impact

Immediate Remediation

Step 1: Update or Deactivate Maps Marker Pro

# Via WP-CLI — update the plugin
wp plugin update maps-marker-pro
 
# Verify installed version
wp plugin get maps-marker-pro --field=version

If an update is not yet available, deactivate the plugin immediately:

wp plugin deactivate maps-marker-pro

Step 2: Audit the Database for Unauthorized Changes

# Check for unexpected administrator accounts
wp user list --role=administrator
 
# Review recently modified posts/options that could indicate DB tampering
wp option list --search='*inject*'
 
# Verify WordPress options for unexpected entries
wp option get siteurl
wp option get admin_email

Step 3: Rotate All Exposed Credentials

After any confirmed SQL injection exposure, assume all database-stored secrets are compromised:

1. Change all WordPress administrator passwords
2. Rotate the database password and update wp-config.php
3. Invalidate active sessions: wp user session destroy --all --all-users
4. Regenerate security keys and salts: wp config shuffle-salts
5. Rotate all plugin API keys stored in the WordPress options table

Detection Indicators

Detection via WAF / IDS Rules

Common SQL injection payloads to watch for in request parameters targeting this plugin:

' OR 1=1--
UNION SELECT null,null,null--
'; INSERT INTO wp_users--
' AND SLEEP(5)--

Configure WAF rules to block SQLi patterns on Maps Marker Pro endpoints and monitor web server logs for these signatures.

Post-Remediation Checklist

1. Confirm plugin updated to a patched version
2. Audit wp_users — remove any unauthorized accounts
3. Review wp_options for unauthorized modifications
4. Rotate all admin passwords and API credentials
5. Regenerate WordPress authentication keys
6. Enable a WAF (Wordfence, Sucuri, Cloudflare) with SQLi rulesets
7. Review server error logs and database slow query logs for exploitation evidence
8. Consider enabling query logging temporarily to detect ongoing attacks

References

• NIST NVD — CVE-2026-73183

Related Advisories

• Critical Unauthenticated RCE in JetEngine WordPress Plugin
• Critical RCE in WPvivid Backup Plugin Threatens 900,000+
• WordPress Plugin Vulnerability (CVSS 10.0) Under Active Exploitation