CVE-2026-4061: Geo Mashup WordPress Plugin SQL Injection

The Geo Mashup plugin for WordPress, in all versions up to and including 1.13.18, is vulnerable to time-based SQL injection. The National Vulnerability Database reports this flaw, identified as CVE-2026-4061, stems from improper sanitization of the map_post_type parameter. Specifically, the SearchResults hook explicitly calls stripslashes_deep($_POST), bypassing WordPress’s magic quotes protection. Subsequently, the unsanitized map_post_type value is directly concatenated into an IN(...) SQL clause without using esc_sql() or $wpdb->prepare().

This oversight allows unauthenticated attackers to inject malicious SQL queries. By leveraging a time-based blind approach, they can extract sensitive information from the database. The National Vulnerability Database notes that exploitation is contingent on the Geo Search feature being enabled within the plugin settings. The vulnerability carries a CVSS score of 7.5 (High severity).

This is a fundamental failure in input validation, exacerbated by explicitly removing built-in protections. For defenders, it’s a stark reminder that even seemingly innocuous plugin parameters can harbor critical vulnerabilities when developers misunderstand or bypass core security functions. Attackers constantly probe for these exact scenarios, where a simple URL parameter can lead to full database compromise.