PT-2026-36607 · WordPress · Geo Mashup
Naoya Takahashi
·
Published
2026-05-02
·
Updated
2026-05-02
·
CVE-2026-4061
CVSS v3.1
7.5
High
| Vector | AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N |
Name of the Vulnerable Software and Affected Versions
Geo Mashup versions prior to 1.13.19
Description
The Geo Mashup plugin for WordPress allows unauthenticated attackers to extract sensitive database information using a time-based blind SQL Injection approach. This occurs because the
SearchResults hook uses stripslashes deep($ POST), which removes protection, and subsequently concatenates the unsanitized map post type parameter into an IN(...) clause without using esc sql() or $wpdb->prepare(). This issue is specifically present in the else branch of the code, whereas the any branch is correctly handled. Exploitation is possible only if the Geo Search feature is enabled in the plugin settings.Recommendations
Update to a version later than 1.13.18.
As a temporary workaround, disable the Geo Search feature in the plugin settings to minimize the risk of exploitation.
Fix
SQL injection
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Geo Mashup