External risk intelligence

SQL Injection in Maps Marker Pro Versions Prior to 4.33

CVE advisorySeverity: CRITICAL (CVSS 9.3)

CVE-2026-73183

This vulnerability affects a WordPress plugin designed for mapping and location services. Such plugins are typically deployed on public-facing websites to provide interactive content to visitors, making the vulnerable endpoints commonly accessible over the internet.

SQL Injection

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

This advisory concerns an unauthenticated SQL injection vulnerability found in a popular mapping plugin for websites. The flaw could potentially allow unauthorized access to sensitive information stored in the website's database. The main concern is confirming the relevance and exposure of this plugin within our web presence.

Unauthorized database access risk exists.
Affects public-facing mapping tools.
Confirm relevance and exposure.

Attack Path

How an attacker could exploit the issue

An unauthenticated attacker can exploit this vulnerability by sending specially crafted data over the network to the Maps Marker Pro plugin. This input targets a flaw in how the plugin handles data, potentially leading to unauthorized access to sensitive database information and disruption of service.

No authentication required for attack.
SQL injection in plugin's handling of data.
Sensitive data disclosure and service disruption.

Live Threat

Current exploitation, exposure, and threat context

An unauthenticated SQL injection vulnerability in Maps Marker Pro could allow an attacker to access, modify, or delete sensitive information stored in the application's database. This could occur when the plugin is active and exposed to network access, potentially impacting the integrity and availability of mapping data.

Database information.
Via unauthenticated network requests.
Data compromise or disruption.

Operational Fix

Recommended remediation, mitigation, and detection steps

This unauthenticated SQL injection vulnerability in Maps Marker Pro impacts systems that use the plugin for mapping functionalities. The first practical step is to identify all deployments of this plugin, assess their internet reachability and business criticality, and then pinpoint the accountable owner. This will enable a risk-based remediation plan to be developed.

Application owners should address the issue.
Verify plugin reachability and criticality.
Coordinate remediation with vendor.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is the Maps Marker Pro plugin?

Maps Marker Pro is a WordPress plugin used to display interactive maps, manage locations, and provide geospatial services on websites. It acts as an extension to the WordPress platform, enabling site administrators to integrate custom location data and routing features into their pages for site visitors to interact with.

What does CVE-2026-73183 mean in plain English?

This vulnerability is a type of SQL injection, categorized as CWE-89. It means the plugin fails to properly filter or clean data sent to it by users. Because of this, an attacker can insert malicious database commands into the system. The software mistakenly runs these commands, potentially allowing unauthorized access to the underlying website database.

How can an attacker trigger this SQL injection?

An attacker triggers this flaw by sending specifically crafted network requests to the plugin. Because it is an unauthenticated issue, the attacker does not need a user account or special permissions on the website to initiate the attack. However, the plugin must be active on the site for the vulnerability to be reachable; if the plugin is disabled, these requests will not impact the database.

Is my website at risk from this vulnerability?

According to Halo Surface Signal, this plugin is typically used for public-facing mapping content, which often makes it accessible over the internet. If your website uses an affected version of Maps Marker Pro and is reachable by the public, it is considered internet-facing and carries a higher potential for unauthorized access compared to internal-only systems.

What should I do if I am running Maps Marker Pro?

Your first step is to locate every instance of the plugin running in your environment. Once identified, evaluate whether those specific websites are critical to your operations and verify their current network exposure. Afterward, determine who owns or manages each site to coordinate with them on applying necessary security updates from the vendor to resolve the flaw.

References

patchstack.com/database/wordpress/plugin/maps-marker-pro/vulnerabili…

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.