CVE-2023-0037 — AI Deep Analysis Summary

Q: Who is affected? (Versions/Components)

📦 **Product**: 10Web Map Builder for Google Maps (WordPress Plugin). 📉 **Affected Versions**: **< 1.0.73** (i.e., 1.0.72 and earlier). 🌐 **Platform**: WordPress sites using this specific plugin.

Q: Is exploitation threshold high? (Auth/Config)

📉 **Threshold: LOW**. 🔑 **Auth**: **Unauthenticated** access required. ⚙️ **Config**: Exploits via AJAX actions exposed to the public. 🎯 **Ease**: High. No credentials needed to trigger the injection.

Q: Is there a public Exp? (PoC/Wild Exploitation)

📜 **Public Exploit**: Yes. 🔗 **PoC**: Available via **ProjectDiscovery Nuclei Templates** (CVE-2023-0037.yaml). 🌍 **Wild Exploitation**: Likely, given the unauthenticated nature and public PoC availability.

Q: Is it fixed officially? (Patch/Mitigation)

✅ **Fixed**: Yes. 🔧 **Patch**: Upgrade to version **1.0.73** or later. 📝 **Source**: Vendor release notes and WPScan vulnerability entry confirm the fix in 1.0.73.

Q: Is it urgent? (Priority Suggestion)

🔥 **Priority: HIGH**. ⏱️ **Urgency**: Immediate action required. 📢 **Reason**: Unauthenticated SQLi allows full database compromise. Public PoC exists. Low barrier to entry for attackers.

Updated May 08, 2026

This is a summary of the AI-generated 10-question deep analysis. The full version (longer answers, follow-up Q&A, related CVEs) requires login. Read the full analysis →

Q1What is this vulnerability? (Essence + Consequences)

🚨 **Essence**: SQL Injection (SQLi) in WordPress plugin **10WebMapBuilder**. <br>⚠️ **Consequences**: Attackers can manipulate SQL queries, leading to data theft, modification, or deletion.…

Read full answer (login)

Q2Root Cause? (CWE/Flaw)

🛡️ **Root Cause**: Improper sanitization and escaping of user-supplied parameters before SQL execution. <br>🔍 **CWE**: Not explicitly listed in data, but classic **SQL Injection** flaw (CWE-89).…

Read full answer (login)

Q3Who is affected? (Versions/Components)

📦 **Product**: 10Web Map Builder for Google Maps (WordPress Plugin). <br>📉 **Affected Versions**: **< 1.0.73** (i.e., 1.0.72 and earlier). <br>🌐 **Platform**: WordPress sites using this specific plugin.

Q4What can hackers do? (Privileges/Data)

💀 **Attacker Actions**: <br>1. **Extract Data**: Read sensitive database contents (users, configs, other site data). <br>2. **Modify Data**: Change or delete records. <br>3.…

Read full answer (login)

Q5Is exploitation threshold high? (Auth/Config)

📉 **Threshold: LOW**. <br>🔑 **Auth**: **Unauthenticated** access required. <br>⚙️ **Config**: Exploits via AJAX actions exposed to the public. <br>🎯 **Ease**: High. No credentials needed to trigger the injection.

Q6Is there a public Exp? (PoC/Wild Exploitation)

📜 **Public Exploit**: Yes. <br>🔗 **PoC**: Available via **ProjectDiscovery Nuclei Templates** (CVE-2023-0037.yaml). <br>🌍 **Wild Exploitation**: Likely, given the unauthenticated nature and public PoC availability.

Q7How to self-check? (Features/Scanning)

🔍 **Self-Check**: <br>1. Scan for **10Web Map Builder** plugin version < 1.0.73. <br>2. Use **Nuclei** with the specific CVE template. <br>3.…

Read full answer (login)

Q8Is it fixed officially? (Patch/Mitigation)

✅ **Fixed**: Yes. <br>🔧 **Patch**: Upgrade to version **1.0.73** or later. <br>📝 **Source**: Vendor release notes and WPScan vulnerability entry confirm the fix in 1.0.73.

Q9What if no patch? (Workaround)

🚧 **Workaround (If no patch)**: <br>1. **Disable/Deactivate** the 10Web Map Builder plugin immediately. <br>2. **Restrict Access**: Block AJAX endpoints via WAF if possible. <br>3.…

Read full answer (login)

Q10Is it urgent? (Priority Suggestion)

🔥 **Priority: HIGH**. <br>⏱️ **Urgency**: Immediate action required. <br>📢 **Reason**: Unauthenticated SQLi allows full database compromise. Public PoC exists. Low barrier to entry for attackers.

Continue exploring

Vulnerability detail Full AI analysis (login) Unknown