{"id":"CVE-2026-111399","kind":"vulnerability","aliases":["CVE-2026-111399"],"related":[],"title":"MapSVG WordPress plugin: SQL injection lets attackers read or change site data","description":"Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in PT Norther Lights Production MapSVG mapsvg-lite-interactive-vector-maps allows SQL Injection.This issue affects MapSVG: from n/a through 8.16.1.","summary":"The MapSVG interactive vector maps plugin for WordPress fails to neutralize special SQL characters in input, enabling SQL injection. An attacker who can reach the vulnerable request can read or alter the site database.","severity":"high","cvss":8.5,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["mapsvg","package","self-hosted","wordpress"],"not_affected_if":["plugin-not-installed"],"how_to_check":"- Check the installed version of the `mapsvg-lite-interactive-vector-maps` plugin in the WordPress admin plugin list or `wp plugin get mapsvg-lite-interactive-vector-maps --field=version`\n- Compare against `8.16.1`; versions up to and including `8.16.1` are listed as affected","fix":"- Update the `mapsvg-lite-interactive-vector-maps` plugin to a version newer than `8.16.1` once the vendor releases one; the sources do not name a fixed version\n- Until patched, deactivate the plugin if maps are not needed","status":"open","published_at":"2026-10-16T13:16:55+00:00","first_seen_at":"2026-10-23T21:57:13+00:00","triaged_at":"2026-10-25T03:01:36+00:00","updated_at":"2026-10-25T03:01:36+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-10-25T03:01:36Z","model":"claude-haiku-5-5","output":{"fix":"- Update the `mapsvg-lite-interactive-vector-maps` plugin to a version newer than `8.16.1` once the vendor releases one; the sources do not name a fixed version\n- Until patched, deactivate the plugin if maps are not needed","reach":"internet","title":"MapSVG WordPress plugin: SQL injection lets attackers read or change site data","impact":"high","summary":"The MapSVG interactive vector maps plugin for WordPress fails to neutralize special SQL characters in input, enabling SQL injection. An attacker who can reach the vulnerable request can read or alter the site database.","category":"package","nicknames":[],"who_cares":["wordpress","mapsvg","self-hosted"],"confidence":0.6,"needs_auth":"unknown","worst_case":"Attacker reads or modifies the WordPress database contents","analyst_note":"Check the NVD entry and the WordPress plugin changelog for the fixed version and whether authentication is required for the vulnerable endpoint.","how_to_check":"- Check the installed version of the `mapsvg-lite-interactive-vector-maps` plugin in the WordPress admin plugin list or `wp plugin get mapsvg-lite-interactive-vector-maps --field=version`\n- Compare against `8.16.1`; versions up to and including `8.16.1` are listed as affected","needs_analyst":true,"not_affected_if":["plugin-not-installed"],"who_is_affected":"Sites running the MapSVG (mapsvg-lite-interactive-vector-maps) WordPress plugin at version 8.16.1 or earlier are affected. Sites that do not have the plugin installed can skip this. Whether an unauthenticated attacker can reach the flawed request is not stated in the sources.","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000653,"input_tokens":3324,"output_tokens":642,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-111399':15A,18A '-2026':14A,17A '8.16.1':93C 'affect':88C 'allow':84C 'alter':55B 'attack':7A,45B 'chang':10A 'charact':38B 'command':68C 'cve':13A,16A 'data':12A 'databas':58B 'element':63C 'enabl':41B 'fail':33B 'host':23B 'improp':59C 'inject':5A,43B,70C 'injection.this':86C 'input':40B 'interact':27B,81C 'issu':87C 'let':6A 'light':75C 'lite':80C 'map':29B,83C 'mapsvg':1A,19B,26B,77C,79C,89C 'mapsvg-lite-interactive-vector-map':78C 'n/a':91C 'neutral':35B,60C 'norther':74C 'packag':20B 'plugin':3A,30B 'product':76C 'pt':73C 'reach':48B 'read':8A,53B 'request':51B 'self':22B 'self-host':21B 'site':11A,57B 'special':36B,62C 'sql':4A,37B,42B,67C,69C,85C 'use':64C 'vector':28B,82C 'vulner':50B,71C 'wordpress':2A,24B,32B","nicknames":[],"mitigations":[],"who_affected":"Sites running the MapSVG (mapsvg-lite-interactive-vector-maps) WordPress plugin at version 8.16.1 or earlier are affected. Sites that do not have the plugin installed can skip this. Whether an unauthenticated attacker can reach the flawed request is not stated in the sources.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-16T13:16:55+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:L","cvss_by":"audit@patchstack.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-111399","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-111399","severity":null,"published_at":"2026-10-16T13:16:55+00:00","modified_at":"2026-10-16T15:19:36+00:00","first_seen_at":"2026-10-23T21:57:13+00:00","fetched_at":"2026-10-23T22:28:55+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}