An unauthenticated time-based SQL injection vulnerability in the Geo Mashup plugin for WordPress allows remote attackers to extract sensitive database information.

This flaw is classified as an SQL injection vulnerability (CWE-89) stemming from unsanitized input in the map_post_type parameter processed by the SearchResults hook, allowing unauthenticated attackers to execute arbitrary database queries.

Successful exploitation of this vulnerability can lead to the unauthorized extraction of sensitive information from the underlying database, potentially exposing confidential business or user data. With a CVSS score of 7.5, the high severity reflects the potential for severe data compromise without requiring any prior authentication or user interaction.

Immediate Action: Review vendor advisories for a patched release of the Geo Mashup plugin and update immediately, or temporarily deactivate the plugin and disable the Geo Search feature if no patch is available.

Proactive Monitoring: Monitor database query logs for anomalous, lengthy execution times or unusual error patterns indicative of time-based blind SQL injection attempts.

Compensating Controls: Deploy a Web Application Firewall rule to inspect and block requests containing SQL injection payloads targeting the map_post_type parameter.

Public Exploit Available: No - As of May 4, 2026, there is no confirmed public exploit available in our curated sources.

Given the high severity and potential for unauthenticated data exfiltration, administrators must prioritize monitoring for vendor updates. Applying the official software patch as soon as it is released is critical to neutralizing the risk of database compromise.