---
id: "CVE-2026-111399"
kind: "vulnerability"
aliases: ["CVE-2026-111399"]
title: "MapSVG WordPress plugin: SQL injection lets attackers read or change site data"
severity: "high"
cvss: 8.5
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["mapsvg", "package", "self-hosted", "wordpress"]
not_affected_if: ["plugin-not-installed"]
published_at: "2026-10-16T13:16:55+00:00"
first_seen_at: "2026-10-23T21:57:13+00:00"
updated_at: "2026-10-25T03:01:36+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-111399", "first_seen_at": "2026-10-23T21:57:13+00:00"}]
---

# MapSVG WordPress plugin: SQL injection lets attackers read or change site data

The MapSVG interactive vector maps plugin for WordPress fails to neutralize special SQL characters in input, enabling SQL injection. An attacker who can reach the vulnerable request can read or alter the site database.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed version of the `mapsvg-lite-interactive-vector-maps` plugin in the WordPress admin plugin list or `wp plugin get mapsvg-lite-interactive-vector-maps --field=version`
- Compare against `8.16.1`; versions up to and including `8.16.1` are listed as affected

## Fix

- Update the `mapsvg-lite-interactive-vector-maps` plugin to a version newer than `8.16.1` once the vendor releases one; the sources do not name a fixed version
- Until patched, deactivate the plugin if maps are not needed

## Timeline

- 2026-10-23T21:57:13+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-111399

## From the sources

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in PT Norther Lights Production MapSVG mapsvg-lite-interactive-vector-maps allows SQL Injection.This issue affects MapSVG: from n/a through 8.16.1.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_