An unauthenticated time-based SQL injection vulnerability in the Geo Mashup plugin for WordPress allows attackers to extract sensitive database information.

This vulnerability is an Improper Neutralization of Special Elements used in an SQL Command, identified as CWE-89, affecting the sort parameter and query handling. Unauthenticated attackers can exploit this flaw remotely over the network without requiring user interaction.

A successful exploitation of this vulnerability can lead to the unauthorized extraction of sensitive data from the underlying database through a time-based blind SQL injection approach. This unauthorized data access compromises confidentiality and can result in significant regulatory, operational, and reputational damage. The associated CVSS score of 7.5 reflects a high severity risk that requires prompt attention.

Immediate Action: Update the Geo Mashup plugin to a version newer than 1.13.18 once a patched release is available, or temporarily deactivate the plugin if no fix is currently provided.

Proactive Monitoring: Monitor web server logs and database query logs for unusual time-delay patterns, suspicious SQL syntax, or anomalous unauthenticated requests targeting mapping endpoints.

Compensating Controls: Deploy a Web Application Firewall rule to inspect and block requests containing SQL injection payloads within the sort parameter.

Public Exploit Available: No (only a Nuclei detection template exists; no weaponized exploit or public proof-of-concept is confirmed).

Given the high severity score and the potential for unauthorized data extraction by unauthenticated actors, administrators must prioritize mitigating this flaw. Organizations should apply vendor updates immediately upon release or remove the vulnerable plugin if it is non-essential to business operations.