CVE-2021-24130
📋 TL;DR
This vulnerability allows authenticated administrators in WordPress to perform SQL injection attacks through the WP Google Map Plugin's Manage Locations page. Attackers with admin privileges can execute arbitrary SQL commands, potentially compromising the database. Only WordPress sites using vulnerable versions of the WP Google Map Plugin are affected.
💻 Affected Systems
- WP Google Map Plugin for WordPress
📦 What is this software?
Wp Maps by Weplugins
⚠️ Risk & Real-World Impact
Worst Case
Complete database compromise including data theft, data manipulation, privilege escalation to full system access, or complete site takeover.
Likely Case
Data exfiltration from the WordPress database, including sensitive user information, plugin settings, or site configuration data.
If Mitigated
Limited impact with proper input validation and parameterized queries preventing SQL injection.
🎯 Exploit Status
Exploitation requires admin-level access. SQL injection techniques are well-documented and tools like sqlmap can automate exploitation.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 4.1.5
Vendor Advisory: https://wpscan.com/vulnerability/46af9a4d-67ac-4e08-a753-a2a44245f4f8
Restart Required: No
Instructions:
1. Log into WordPress admin panel. 2. Navigate to Plugins > Installed Plugins. 3. Find 'WP Google Map Plugin'. 4. Click 'Update Now' if update is available. 5. Alternatively, download version 4.1.5+ from WordPress repository and manually update.
🔧 Temporary Workarounds
Remove vulnerable plugin
allTemporarily disable or remove the WP Google Map Plugin until patched
wp plugin deactivate wp-google-map-plugin
wp plugin delete wp-google-map-plugin
Restrict admin access
allLimit administrator accounts to only trusted personnel and implement strong authentication
🧯 If You Can't Patch
- Implement web application firewall (WAF) with SQL injection rules
- Restrict database user permissions to minimum required privileges
🔍 How to Verify
Check if Vulnerable:
Check WordPress admin panel > Plugins > Installed Plugins for WP Google Map Plugin versionCheck Version:
wp plugin get wp-google-map-plugin --field=versionVerify Fix Applied:
Verify plugin version is 4.1.5 or higher in WordPress admin panel📡 Detection & Monitoring
Log Indicators:
- Unusual SQL queries in database logs
- Multiple failed login attempts followed by admin access
- Unexpected database schema changes
Network Indicators:
- Unusual database connection patterns from web server
- Large data exfiltration from database
SIEM Query:
source="wordpress.log" AND "wp-google-map-plugin" AND ("sql" OR "database" OR "injection")