The Geo Mashup plugin for WordPress contains an unauthenticated SQL injection vulnerability that poses a severe risk of unauthorized database data exfiltration.

The vulnerability is caused by improper neutralization of special elements used in an SQL command (CWE-89) within the sort parameter. An unauthenticated attacker can supply malicious input to append unauthorized SQL queries to the existing database operations.

Successful exploitation of this vulnerability allows an attacker to bypass authentication and execute arbitrary SQL queries against the WordPress database. This can lead to the unauthorized disclosure of sensitive information, such as user credentials, configuration details, or proprietary content. Given the CVSS score of 7.5, this high severity flaw represents a significant risk to data confidentiality and regulatory compliance.

Immediate Action: As no specific patched version is confirmed in the provided data, administrators should immediately deactivate or remove the Geo Mashup plugin until a secure update is verified by the vendor.

Proactive Monitoring: Security teams should review database access logs for unusual query patterns, particularly those involving the sort parameter or attempts to use SQL syntax like UNION or SELECT statements.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to detect and block common SQL injection patterns to provide a virtual patch layer while the plugin remains inactive.

Public Exploit Available: exploit_available (unknown)

The presence of an unauthenticated SQL injection vulnerability in a widely used plugin creates a significant security gap. Organizations using the Geo Mashup plugin must prioritize its immediate removal or deactivation to prevent potential data breaches. Administrators should monitor official vendor channels for the release of a secure version before considering re-enabling the component.