CVE-2026-39492 is an unauthenticated SQL Injection vulnerability (CWE-89) in the WP Maps plugin for WordPress developed by Flipper Code. It affects versions up to and including 4.9.1. The vulnerability allows remote attackers to inject SQL commands without requiring authentication, resulting in a high impact on data confidentiality and a low impact on availability. The CVSS v3.1 base score is 9.3, reflecting network attack vector, low attack complexity, no privileges required, no user interaction, and scope change. No official patch or remediation level has been provided by the vendor or authoritative sources as of the published date.

Successful exploitation can lead to unauthorized disclosure of sensitive data (high confidentiality impact) and limited disruption of service (low availability impact). Integrity impact is not indicated. The vulnerability can be exploited remotely without authentication, increasing the risk to affected systems.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, consider disabling or restricting access to the WP Maps plugin to prevent exploitation. Monitor for updates from the vendor or trusted security sources.