This vulnerability (CVE-2026-66618) is an administrator SQL Injection flaw in WP Maps versions up to 4.9.9. It stems from improper neutralization of special elements used in SQL commands (CWE-89). The CVSS 3.1 score is 7.6, indicating high severity, with network attack vector, low attack complexity, and requiring high privileges but no user interaction. The impact includes high confidentiality loss and low availability impact, with no integrity impact. No known exploits in the wild or vendor patch information is provided.

Successful exploitation could allow an attacker with administrator privileges to execute arbitrary SQL commands, potentially leading to unauthorized disclosure of sensitive data (high confidentiality impact) and partial denial of service (low availability impact). Integrity is not impacted according to the CVSS vector. No known active exploitation is reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no patch or official fix information is provided, administrators should monitor vendor communications for updates. Restricting administrator access and following least privilege principles may reduce risk until a fix is available.