What is the CVSS score of CVE-2026-4060?

CVE-2026-4060 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.1%.

Which versions of Geo Mashup are affected by CVE-2026-4060?

CVE-2026-4060 is a time-based SQL injection vulnerability in WordPress Geo Mashup plugin versions 1.13.18 and earlier that allows unauthenticated attackers to extract sensitive database information…

How to fix or mitigate CVE-2026-4060?

Within 24 hours: Disable or deactivate the Geo Mashup plugin on all WordPress installations and document current version numbers. Within 7 days: Audit database access logs for suspicious queries containing time-based SQL injection patterns (e.g., SLEEP, BENCHMARK functions in sort parameters). Within 30 days: Either upgrade to Geo Mashup version 1.13.19 or later once available, or replace the plugin with an alternative geolocation solution; conduct a full database integrity check and monitor for unauthorized data access.

Geo Mashup CVE-2026-4060

EUVD-2026-26778 HIGH

SQL Injection (CWE-89)

2026-05-02 Wordfence

PHP WordPress SQLi

7.5

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

May 02, 2026 - 12:30 vuln.today

EUVD ID Assigned

May 02, 2026 - 12:00 euvd

EUVD-2026-26778

Analysis Generated

May 02, 2026 - 12:00 vuln.today

CVE Published

May 02, 2026 - 11:16 nvd

HIGH 7.5

DescriptionCVE.org

The Geo Mashup plugin for WordPress is vulnerable to Time-Based SQL Injection via the 'sort' parameter in all versions up to, and including, 1.13.18. This is due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. The esc_sql() function is applied but is ineffective in the ORDER BY context because the value is not enclosed in quotes. Additionally, while a sanitize_sort_arg() allowlist-based sanitizer was added in version 1.13.18, it is only applied in the AJAX code path (sanitize_query_args()) and not in the render-map.php or template tag code paths. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database via a time-based blind approach.

AnalysisAI

Time-based SQL injection in WordPress Geo Mashup plugin ≤1.13.18 allows unauthenticated remote attackers to extract sensitive database information. The 'sort' parameter in multiple code paths (render-map.php, template tags) lacks proper sanitization despite esc_sql() application, which is ineffective in ORDER BY contexts without quote encapsulation. Version 1.13.18 added allowlist-based sanitization but only protected the AJAX endpoint, leaving other attack vectors exploitable. EPSS and KEV data not available; vulnerability disclosed by Wordfence with public source code references confirming the flaw.

Technical ContextAI

This vulnerability affects the Geo Mashup WordPress plugin (cpe:2.3:a:cyberhobo:geo_mashup), a geolocation mapping tool for WordPress. The root cause is CWE-89 (SQL Injection) stemming from improper neutralization of special elements in SQL commands. Specifically, the plugin uses PHP's esc_sql() function on user-supplied 'sort' parameter values before inserting them into ORDER BY clauses, but this defense is ineffective because ORDER BY values are not quote-enclosed in SQL syntax. The sanitize_sort_arg() allowlist validator introduced in version 1.13.18 only protects the sanitize_query_args() AJAX code path, while render-map.php (line 166) and template tag functions remain vulnerable. The geo-mashup-db.php file (lines 1767, 1785) contains the vulnerable query construction logic. Time-based blind SQL injection techniques allow attackers to infer database contents character-by-character by measuring response delays, bypassing the lack of direct error messages or data output.

RemediationAI

Update to Geo Mashup version 1.13.19 or later, which applies changeset 3503627 containing comprehensive fixes across all code paths (https://plugins.trac.wordpress.org/changeset/3503627/). The patch extends sanitize_sort_arg() allowlist validation to render-map.php and template tag functions, not just AJAX handlers. If immediate patching is impossible, implement compensating controls with these specific trade-offs: (1) Disable the Geo Mashup plugin entirely until patching (eliminates attack surface but removes all mapping functionality), (2) Deploy WordPress Web Application Firewall (WAF) rules blocking requests with 'sort' parameter containing SQL keywords like SLEEP, BENCHMARK, WAITFOR (reduces but doesn't eliminate risk due to obfuscation techniques; may cause false positives if legitimate sort values match keywords), (3) Restrict wp-admin access to trusted IP addresses and implement database activity monitoring for slow queries exceeding 5-10 seconds (detection-focused control, doesn't prevent exploitation but enables incident response). Note that version 1.13.18 provides FALSE protection-administrators must verify they're running 1.13.19+ via WordPress admin dashboard or wp-content/plugins/geo-mashup/geo-mashup.php version header. Wordfence advisory at https://www.wordfence.com/threat-intel/vulnerabilities/id/2fa5ae9a-532c-40f9-b70a-217f0f9cd473 contains additional context.