CVE-2024-3604 is a critical SQL injection (CVSS 9.9) in the OSM OpenStreetMap plugin for WordPress, in all versions up to and including 6.0.3. The tagged_filter attribute of the osm_map_v3 shortcode is insufficiently escaped. Attackers with contributor access or higher can read data. Update the plugin and review who holds contributor roles.
Weakness class: CWE-89.
What's affected
- Product: OSM, OpenStreetMap plugin for WordPress, by hyumika.
- Affected: all versions up to and including 6.0.3.
- Fixed version: the record does not state one. It links a WordPress plugin changeset (3153019) that I could not read. The WordPress.org page lists version 6.2.6 as current but its page text did not confirm which release carried this fix, so check the plugin changelog.
- Access needed: an authenticated user with contributor level or above.
- Severity: Critical, CVSS 9.9, per the record. The KEV flag is false.
How to check if you're exposed
- In the WordPress admin, open Plugins and read the version of OSM.
- With WP-CLI, list the plugin version on each site.
wp plugin list | grep osm
- List users who can write posts, with the same query for the author and editor roles.
wp user list --role=contributor
- Search posts for osm_map_v3 shortcodes that carry a tagged_filter attribute you do not recognise.
What to do now
- Update OSM to the newest release and confirm in the changelog that it covers the tagged_filter fix.
- If you cannot update, deactivate the plugin.
- Review contributor and author accounts and remove any you do not recognise.
- Turn off open registration with contributor defaults if you do not need it.
- Check the database for unexpected users or options after any suspect period.
Why it matters
The class is CWE-89. The attribute value is placed into a query without proper preparation. The record says the query was not prepared and the parameter not escaped, which is the textbook cause. The authenticated requirement does not make it minor: the score is 9.9 because the changed scope lets a low privilege account affect data beyond its own.
WordPress sites often have many contributors, such as guest writers and members. Any one of those accounts, if phished or created by open registration, becomes a way in. That is why least privilege for roles matters for plugin bugs of this type.
Shortcodes are a recurring source of this class, since their attributes come from post content, which is editable by users.
Quick check
Do I need contributor access to be at risk?
The attacker does. If your site has no contributors or open registration, exposure is lower, but update anyway.
Which version fixes it?
The record does not say. Check the plugin changelog and the changeset it links.
Sources
Last reviewed: 19 October 2026.
