Time-Based SQL Injection Vulnerability in Geo Mashup Plugin for WordPress

CVE-2026-4060

What is CVE-2026-4060?

The Geo Mashup plugin for WordPress is exposed to a Time-Based SQL Injection vulnerability through the 'sort' parameter. This issue arises from inadequate escaping of user-supplied input and insufficient preparation of the SQL query. Although the esc_sql() function is utilized, it fails to effectively secure the ORDER BY context given that the parameter's value lacks necessary quotation. Furthermore, an allowlist-based sanitizer implemented in version 1.13.18 (sanitize_sort_arg()) only protects AJAX code paths, leaving template tag code paths and render-map.php unprotected. This vulnerability enables unauthenticated attackers to inject additional SQL queries into existing ones, facilitating the potential retrieval of sensitive data from the database via time-based blind methods.

References