CVE-2026-39492 describes an unauthenticated SQL Injection vulnerability in WP Maps versions <= 4.9.1. The flaw allows remote attackers to inject SQL commands without any authentication, resulting in a critical security risk. The vulnerability is classified under CWE-89 (Improper Neutralization of Special Elements used in an SQL Command). The CVSS 3.1 base score is 9.3, reflecting network attack vector, low attack complexity, no privileges required, no user interaction, scope change, high confidentiality impact, no integrity impact, and low availability impact. No patch or official remediation level has been published by the vendor or the assigner Patchstack as of the publication date.

Successful exploitation of this vulnerability could allow an unauthenticated attacker to execute arbitrary SQL commands on the affected WP Maps plugin database. This can lead to unauthorized disclosure of sensitive information (high confidentiality impact) and partial disruption of service (low availability impact). There is no indication of integrity impact. The vulnerability affects all users running WP Maps version 4.9.1 or earlier.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider disabling or restricting access to the WP Maps plugin to prevent exploitation. Monitor official communications from Flipper Code and Patchstack for updates on patches or workarounds.