PT-2026-36608 · WordPress · Geo Mashup

Naoya Takahashi · Published 2026-05-02 · Updated 2026-05-02 · CVE-2026-4062

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Geo Mashup versions prior to 1.13.19

Description The Geo Mashup plugin for WordPress contains a time-based blind SQL injection flaw. This issue allows unauthenticated attackers to append additional SQL queries to existing ones to extract sensitive information from the database. The flaw exists because user-supplied parameters are not sufficiently escaped or prepared before being used in SQL queries. Specifically, the esc sql() function is used but fails to protect against parenthesis or SQL keyword injection when values are placed in unquoted IN(...) or NOT IN(...) contexts. While a numeric-only sanitizer is present in the sanitize query args() function, it is only utilized in the AJAX code path and is missing from the render-map.php and template tag code paths. The affected parameters are 'object ids' and 'exclude object ids'.

Recommendations Update the plugin to a version later than 1.13.18.

Fix

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2026-4062

Affected Products

Geo Mashup

References · 8

• https://nvd.nist.gov/vuln/detail/CVE-2026-4062 · Security Note
• https://wordfence.com/threat-intel/vulnerabilities/id/abc5ed0a-504f-4d8c-9662-a4c9f7c7acb8?source=cve · Note
• https://plugins.trac.wordpress.org/browser/geo-mashup/trunk/geo-mashup-db.php#L1759 · Note
• https://t.me/CVEtracker/52524 · Telegram Post
• https://plugins.trac.wordpress.org/browser/geo-mashup/trunk/render-map.php#L166 · Note
• https://t.me/cveNotify/161869 · Telegram Post
• https://plugins.trac.wordpress.org/changeset/3503627 · Note
• https://plugins.trac.wordpress.org/browser/geo-mashup/trunk/geo-mashup-db.php#L1755 · Note