Time-Based SQL Injection in Geo Mashup by WordPress

CVE-2026-4061

What is CVE-2026-4061?

A vulnerability exists in the Geo Mashup plugin for WordPress that allows for Time-Based SQL Injection through the 'map_post_type' parameter. The issue arises due to an improper handling of user-supplied input where the 'SearchResults' hook calls stripslashes_deep($_POST), inadvertently removing protections against SQL injection. As a result, the unsanitized 'map_post_type' parameter is directly incorporated into an SQL query without appropriate safety measures, enabling unauthenticated attackers to manipulate queries and extract sensitive information from the database. This vulnerability is primarily exploitable when the Geo Search feature is enabled within the plugin settings.

References