CVE-2026-59527 in the MapSVG WordPress plugin carries a CVSS 9.3, reflecting unauthenticated SQL injection with high confidentiality and integrity impact. The EPSS score of 0.00236 suggests low exploitation probability in the next 30 days. For defenders, the gap between these numbers is the first thing to understand—this isn't a case where EPSS is telling you to ignore the finding. It's telling you that mass scanners and exploit kits aren't currently hammering this vector, likely because exploitation requires specific conditions that generic automated attacks don't target.
The specific condition is MapSVG's SVG parsing and region-based query construction. This SQL injection doesn't trigger from a simple URL parameter injection—it requires the attacker to control map data structures in ways most deployments don't expose externally. If your MapSVG installation accepts user-supplied SVG uploads or map configuration data from untrusted sources, you're in the high-risk category. If MapSVG only processes internally-generated map data, the practical severity drops substantially below what CVSS suggests.
The forward-dated CVE identifier (2026) indicates coordinated disclosure rather than a fresh discovery. This means the vulnerability has likely circulated in private researcher or vendor channels before public registration. The EPSS window may already be measuring post-disclosure activity, not the full exposure period.
What matters practically: audit whether MapSVG accepts external map data or SVG uploads, check whether the plugin writes to shared WordPress tables like wp_options or wp_postmeta, and verify your current MapSVG version against the patched release. The SQL injection itself could allow reading wp_users tables or modifying wp_options—WordPress's shared database runtime means the blast radius extends beyond 'map data' if MapSVG touches core tables. Prioritize patching if you meet any of these conditions: external map data intake, shared-table usage, or plugin versions predating the patch date.