CVE-2021-24130: 
WordPress vulnerability analysis and mitigation

The vulnerability CVE-2021-24130 affects the WP Google Map Plugin for WordPress in versions prior to 4.1.5. The vulnerability was discovered in September 2020 and was finally patched in January 2021. It specifically impacts the Manage Locations page within the plugin settings, where unvalidated input could lead to SQL injection attacks (WPScan).

The vulnerability is classified as an SQL Injection (SQLI) with a CVSS score of 6.6 (medium severity) and is mapped to CWE-89. The security flaw exists in the 'order' and 'orderby' parameters of the Manage Locations page, which failed to properly validate input. The vulnerability requires authentication and can only be exploited by users with administrative privileges (WPScan).

When exploited, this vulnerability could allow authenticated attackers with administrative access to perform SQL injection attacks against the WordPress database. This could potentially lead to unauthorized data access, manipulation of database contents, or other database-related compromises (WPScan).

The vulnerability requires authentication with administrative privileges to exploit. A proof of concept exists demonstrating both boolean-based blind and time-based blind SQL injection techniques. The exploit can be triggered through the manipulation of 'order' and 'orderby' parameters in the plugin's Manage Locations page (WPScan).

The vulnerability was fixed in version 4.1.5 of the WP Google Map Plugin, released on January 27th, 2021. Users are advised to update to this version or later to protect against this vulnerability. It's worth noting that an earlier attempt to fix the issue in version 4.1.4 was unsuccessful (WPScan).