What is the CVSS score of CVE-2026-48967?

CVE-2026-48967 has a CVSS 3.1 base score of 8.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:L. EPSS exploitation probability: 0.3%.

Which versions of Geo Mashup are affected by CVE-2026-48967?

The Geo Mashup WordPress plugin (versions ≤1.13.19) contains a SQL injection vulnerability (CVSS 8.5) that enables registered users to directly query the WordPress database, creating material risk of…

How to fix or mitigate CVE-2026-48967?

Within 24 hours: Inventory all WordPress instances running Geo Mashup plugin ≤1.13.19 and document whether public subscriber registration is enabled. Within 7 days: Either disable the Geo Mashup plugin or restrict subscriber account creation to known, authenticated administrators; implement query logging at the database layer. Within 30 days: Subscribe to vendor security advisories for Geo Mashup; upon patch availability (expected version ≥1.13.20), schedule testing and deployment across all affected instances.

Geo Mashup CVE-2026-48967

EUVD-2026-37612 HIGH

SQL Injection (CWE-89)

2026-06-17 Patchstack

WordPress SQLi Geo Mashup Wordpress Plugin Dylan Kuhn

8.5

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

8.5 HIGH

AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:L

vuln.today AI

8.5 HIGH

Network-reachable WordPress endpoint, low complexity, requires Subscriber auth (PR:L), no user interaction; SQLi reads cross-component data (Scope:Changed, C:H) with no integrity write and limited availability impact.

3.1 AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:L

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:L/SC:H/SI:N/SA:N

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

None

Availability

Low

Lifecycle Timeline

Analysis Generated

Jun 17, 2026 - 12:08 vuln.today

DescriptionCVE.org

Subscriber SQL Injection in Geo Mashup <= 1.13.19 versions.

AnalysisAI

SQL injection in the Geo Mashup WordPress plugin (versions <= 1.13.19) allows authenticated users with Subscriber-level privileges to inject arbitrary SQL queries via unsanitized input, leading to confidentiality compromise and limited availability impact across other WordPress components. No public exploit identified at time of analysis, but the low privilege barrier (any registered subscriber) on a widely-deployed plugin class makes this a meaningful risk for WordPress sites with open registration. The Scope:Changed CVSS metric indicates the SQL injection can affect resources beyond the plugin's own security authority.

Technical ContextAI

Geo Mashup is a WordPress plugin by Dylan Kuhn (CPE: cpe:2.3:a:dylan_kuhn:geo_mashup) that integrates Google Maps and other mapping services to display geotagged posts and content on WordPress sites. The vulnerability falls under CWE-89 (Improper Neutralization of Special Elements used in an SQL Command), meaning user-supplied input reaches a database query without proper parameterization or escaping via the WordPress $wpdb interface. Because the flaw is reachable by Subscriber-role users - the lowest authenticated WordPress role granted automatically on open-registration sites - the effective attack surface is much broader than admin-only plugin flaws.

RemediationAI

Upgrade Geo Mashup to a version newer than 1.13.19 as released by the maintainer - consult the Patchstack advisory at https://patchstack.com/database/wordpress/plugin/geo-mashup/vulnerability/wordpress-geo-mashup-plugin-1-13-19-sql-injection-vulnerability for the exact patched version, as no vendor-released patch version was identified at time of analysis in the input. As compensating controls, deactivate the Geo Mashup plugin until a fix is verified (trade-off: loss of map functionality on the site), disable new user registration via Settings > General > Membership in WordPress (trade-off: blocks legitimate signups but eliminates the Subscriber attack path), or place a Web Application Firewall such as Wordfence or Patchstack mWAF in front of WordPress with virtual patching for this CVE (trade-off: defense-in-depth but not a substitute for the upstream fix). Review wp_users for unauthorized accounts and rotate WordPress secret keys (wp-config.php AUTH_KEY etc.) and admin passwords if compromise is suspected.