Threat database

Unauthenticated Broken Access Control in Advanced Posts Listing – Show Post List Easily <= 1.0.8 versions.

CVE-2026-39492 is a critical unauthenticated SQL Injection vulnerability in the WP Maps plugin by Flipper Code – WordPress Development Company, affecting versions up to and including 4.9.1. This vulnerability allows an attacker to inject SQL commands without authentication, potentially leading to high confidentiality impact and limited availability impact. No official patch or remediation guidance is currently available from the vendor. Users should monitor vendor advisories for updates and consider mitigating exposure until a fix is released.