Sensitive-data disclosure via SQL injection

SQL injection in Maps Marker Pro before 4.32.1 allows remote attackers to read database contents via unspecified public requests. Public records from Patchstack and the vendor confirm the flaw and the fixed version, but they do not disclose the vulnerable parameter, endpoint, or query-construction mistake beyond unsafe handling of attacker-supplied SQL input. No authentication is required to reach the affected code path, so any internet-exposed WordPress site running the plugin before 4.32.1 should be treated as externally reachable; published records describe confidentiality impact with limited service disruption, not direct code execution.