What is the CVSS score of CVE-2026-6457?

CVE-2026-6457 has a CVSS 3.1 base score of 6.5 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.0%.

Geo Mashup WordPress Plugin CVE-2026-6457

EUVD-2026-26759 MEDIUM

SQL Injection (CWE-89)

2026-05-02 Wordfence

WordPress SQLi

6.5

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

6.5 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

May 02, 2026 - 08:15 vuln.today

EUVD ID Assigned

May 02, 2026 - 08:00 euvd

EUVD-2026-26759

Analysis Generated

May 02, 2026 - 08:00 vuln.today

CVE Published

May 02, 2026 - 07:46 nvd

MEDIUM 6.5

DescriptionCVE.org

The Geo Mashup plugin for WordPress is vulnerable to time-based blind SQL Injection via the 'geo_mashup_null_fields' parameter in all versions up to, and including, 1.13.19 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with subscriber-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.

AnalysisAI

Time-based blind SQL injection in Geo Mashup WordPress plugin versions up to 1.13.19 allows authenticated attackers with subscriber-level access to extract sensitive database information via the 'geo_mashup_null_fields' parameter due to insufficient escaping and lack of prepared statement usage. The vulnerability requires valid WordPress authentication but grants high-confidence data confidentiality compromise without requiring user interaction, affecting all installations of this geolocation plugin with vulnerable versions active.

Technical ContextAI

The Geo Mashup plugin for WordPress processes the 'geo_mashup_null_fields' parameter in SQL query construction without proper escaping or parameterized query preparation. The affected code appears in geo-mashup-db.php (line 1991), geo-mashup-ui-managers.php (line 388), and geo-mashup.php (line 567) according to plugin repository references. The vulnerability stems from CWE-89 (SQL Injection), where user-controlled input is concatenated directly into SQL queries without sanitization. This is particularly dangerous in WordPress contexts where the plugin has direct database access through global $wpdb object. Time-based blind SQL injection allows attackers to infer database contents through conditional query delays, circumventing limitations of error-based SQL injection.

RemediationAI

Update Geo Mashup plugin to version 1.13.20 or later, which includes fixes to properly escape the 'geo_mashup_null_fields' parameter and implement prepared statement usage. WordPress administrators should navigate to Plugins > Installed Plugins, locate Geo Mashup, and click Update immediately. As a temporary workaround pending patch application, restrict subscriber-level user creation through Settings > General or use a user registration control plugin (e.g., Restrict Content Pro, MemberPress) to limit authenticated account provisioning, though this does not fully mitigate risk for existing subscriber accounts. Additionally, implement database query logging and monitor for suspicious UNION SELECT, WAITFOR, or SLEEP() patterns in POST requests containing 'geo_mashup_null_fields' parameters. Consider Web Application Firewall (WAF) rules blocking common SQL injection payloads in plugin parameters. The patch reference at changeset 3519909 should be verified in the official WordPress plugin directory prior to application.