CVE-2026-3222: 
WordPress vulnerability analysis and mitigation

CVE-2026-3222 is a time-based blind SQL Injection vulnerability in the WP Maps plugin for WordPress (also known as "WP Maps – Store Locator, Google Maps, OpenStreetMap, Mapbox, Listing, Directory & Filters" by FlipperCode), affecting all versions up to and including 4.9.1. The vulnerability allows unauthenticated remote attackers to extract sensitive information from the WordPress database via the location_id parameter. It was disclosed on March 11, 2026, with Wordfence as the reporting CNA. The CVSS v3.1 base score is 7.5 (High) (Wordfence, Feedly).

The root cause is classified as CWE-89 (Improper Neutralization of Special Elements used in an SQL Command). Two distinct flaws combine to enable exploitation: first, the plugin's database abstraction layer (FlipperCode_Model_Base::is_column()) treats user-supplied input wrapped in backticks as column names, effectively bypassing WordPress's esc_sql() sanitization function; second, the wpgmp_ajax_call AJAX handler is registered for unauthenticated users via the wp_ajax_nopriv hook, allowing arbitrary class method invocation — including wpgmp_return_final_capability — which passes the unsanitized location_id GET parameter directly into a database query. An attacker can append additional SQL statements to existing queries without any authentication or special privileges. Vulnerable code is visible in the plugin source at wp-google-map-plugin.php (lines 250 and 590) and core/class.model.php (line 328) (Wordfence, WP Trac).

Successful exploitation allows unauthenticated attackers to perform time-based blind SQL injection, enabling extraction of sensitive data from the WordPress database — including user credentials (hashed passwords), email addresses, session tokens, and any other data stored in the database. The confidentiality impact is rated High, while integrity and availability are unaffected by this specific vulnerability. In a WordPress context, database credential exposure can facilitate account takeover, privilege escalation to administrator, and potential full site compromise (Wordfence, Feedly).

The vulnerability requires no authentication, no user interaction, and has low attack complexity, making it trivially exploitable by any remote attacker. The EPSS score is approximately 0.207%, indicating a relatively low (but non-negligible) probability of active exploitation in the near term (Feedly). As of the available data, there is no confirmed evidence of in-the-wild exploitation, no known public exploit code, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. No specific threat actor attribution has been reported.

1. Reconnaissance: Identify WordPress sites running the WP Maps plugin (version ≤ 4.9.1) using tools like WPScan, Shodan, or by checking /wp-content/plugins/wp-google-map-plugin/ for plugin presence and version information.
2. Identify the vulnerable AJAX endpoint: The wpgmp_ajax_call handler is accessible unauthenticated at /?action=wpgmp_ajax_call (via WordPress's admin-ajax.php or REST endpoint registered with wp_ajax_nopriv).
3. Invoke the vulnerable method: Craft a GET request that calls the wpgmp_return_final_capability method through the AJAX handler, passing a malicious location_id parameter wrapped in backticks to bypass esc_sql() sanitization.
4. Inject time-based SQL payload: Append a time-based blind SQL payload (e.g., using SLEEP() or BENCHMARK()) to the location_id parameter to confirm injection and enumerate database contents character by character.
5. Extract sensitive data: Use automated tools such as sqlmap with the identified injection point to systematically dump the WordPress wp_users table (usernames, hashed passwords, emails) or other sensitive tables.
6. Post-exploitation: Crack extracted password hashes offline or use extracted session tokens to authenticate as an administrator, enabling full site takeover (Wordfence, WP Trac).

• Network: Unusual HTTP GET requests to wp-admin/admin-ajax.php or equivalent AJAX endpoints with action=wpgmp_ajax_call and a location_id parameter containing backtick characters, SLEEP(), BENCHMARK(), or other SQL keywords; high volume of time-delayed responses from the web server suggesting time-based injection probing.
• Logs: Web server access logs showing repeated requests to admin-ajax.php with action=wpgmp_ajax_call and anomalous location_id values (e.g., containing backticks, SQL functions, or encoded payloads); requests originating from a single IP or small IP range in rapid succession.
• Database: Unexpected or slow-running queries in MySQL slow query logs involving the wp_google_map_locations or related WP Maps tables; queries containing SLEEP, BENCHMARK, or stacked SQL statements.

Users should update the WP Maps plugin to a version beyond 4.9.1, which includes the patch applied in changeset 3475665 that fixes both the is_column() backtick bypass in core/class.model.php and the unsanitized location_id handling in wp-google-map-plugin.php. The patch can be reviewed at the WordPress plugin repository changeset (WP Trac Changeset). As a temporary workaround if immediate update is not possible, consider disabling the WP Maps plugin or restricting access to admin-ajax.php for unauthenticated users via web application firewall (WAF) rules targeting the wpgmp_ajax_call action (Wordfence).

Wordfence included CVE-2026-3222 in their weekly WordPress vulnerability report for March 9–15, 2026, and Sucuri referenced it in their April 2026 vulnerability patch roundup (Wordfence Blog, Sucuri Blog). RedPacketSecurity noted the vulnerability on Mastodon, and several vulnerability tracking aggregators (VulDB, CVEFeed, InfinitSec) published brief coverage shortly after disclosure. Overall community reaction was moderate, consistent with a high-severity but not critical unauthenticated SQL injection in a WordPress plugin.