CVE-2026-4062
Time-Based SQL Injection in Geo Mashup WordPress Plugin
Publication date: 2026-05-02
Last updated on: 2026-05-05
Assigner: Wordfence
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| geo_mashup | geo_mashup | to 1.13.18 (inc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-89 | The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data. |
Attack-Flow Graph
AI Powered Q&A
How can this vulnerability be detected on my network or system? Can you suggest some commands?
Detection of this vulnerability involves monitoring for unusual SQL query patterns that exploit the 'object_ids' and 'exclude_object_ids' parameters in the Geo Mashup plugin. Since the vulnerability is a time-based SQL injection, one can look for delays or time-based anomalies in responses when these parameters are manipulated.
Specific commands or tools to detect this vulnerability are not provided in the available resources.
What immediate steps should I take to mitigate this vulnerability?
Immediate mitigation steps include updating the Geo Mashup plugin to a version later than 1.13.18 where this vulnerability is fixed.
If an update is not immediately possible, restrict access to the vulnerable parameters by implementing web application firewall (WAF) rules to block suspicious requests targeting 'object_ids' and 'exclude_object_ids'.
Additionally, monitor and audit database queries for unusual patterns that may indicate exploitation attempts.
Can you explain this vulnerability to me?
The Geo Mashup plugin for WordPress has a Time-Based SQL Injection vulnerability in the 'object_ids' and 'exclude_object_ids' parameters in all versions up to 1.13.18. This occurs because user-supplied parameters are not properly escaped or prepared in SQL queries. Although the esc_sql() function is used, it only escapes quote characters and does not protect against injection in an unquoted IN(...) or NOT IN(...) SQL context. Additionally, a numeric-only sanitizer is applied only in some code paths but not in others, allowing unauthenticated attackers to inject additional SQL queries. These injected queries can extract sensitive information from the database using a time-based blind SQL injection technique.
How can this vulnerability impact me? :
This vulnerability allows unauthenticated attackers to perform time-based blind SQL injection attacks, which can lead to unauthorized extraction of sensitive information from the database. Since the vulnerability has a high confidentiality impact (C:H) but no impact on integrity or availability, attackers can access confidential data without altering or disrupting the system.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
The vulnerability allows unauthenticated attackers to extract sensitive information from the database via a time-based blind SQL injection. This exposure of sensitive data could lead to non-compliance with data protection regulations such as GDPR and HIPAA, which require safeguarding personal and sensitive information against unauthorized access.