SQL Injection Vulnerability in Geo Mashup Plugin for WordPress

CVE-2026-4062

What is CVE-2026-4062?

The Geo Mashup plugin for WordPress is susceptible to a Time-Based SQL Injection vulnerability due to inadequate parameter escaping and improper SQL query preparation. This weakness allows unauthenticated attackers to inject additional SQL commands via the 'object_ids' and 'exclude_object_ids' parameters. Despite the presence of the esc_sql() function, its effectiveness is compromised as it only escapes quote characters without addressing the potential for parenthesis or SQL keyword injection within the problematic IN(...) / NOT IN(...) context. Moreover, the numeric-only sanitizer in sanitize_query_args() is inconsistently applied, leaving several code paths vulnerable. Consequently, attackers can exploit this flaw to manipulate SQL queries, potentially extracting sensitive information from the database through a time-based blind SQL injection method.

References