Hero Maps Premium WordPress Plugin SQL Injection Vulnerability

A SQL injection vulnerability has been identified in the Hero Maps Premium plugin for WordPress, affecting all versions through 2.3.9. The vulnerability arises from inadequate escaping of user-supplied parameters and insufficient preparation of existing SQL queries, allowing authenticated attackers with Subscriber-level access and above to inject additional SQL queries. This exploitation could lead to the extraction of sensitive information from the database.

Impact

Exploitation of this vulnerability allows for SQL injection, where an attacker can manipulate SQL queries to access or extract sensitive data from the database.

Remediation

There is no known patch available for this vulnerability. Users are advised to review the vulnerability details and consider uninstalling the affected plugin.