An unauthenticated time-based SQL injection vulnerability in the Geo Mashup plugin for WordPress allows remote attackers to extract sensitive database information.

This vulnerability is an SQL injection (CWE-89) flaw residing in the database query handling functions where parameters lack proper preparation and escaping in certain code paths. Unauthenticated attackers can exploit this flaw by manipulating the object_ids and exclude_object_ids parameters.

A successful exploit could allow malicious actors to extract sensitive data from the underlying database through a time-based blind injection technique. Given the CVSS score of 7.5, this high-severity flaw introduces significant risk of data exposure, potentially leading to the compromise of confidential records and regulatory compliance violations.

Immediate Action: Update the Geo Mashup plugin to the latest version as soon as a vendor fix becomes available, or temporarily deactivate the plugin if no patch is currently released.

Proactive Monitoring: Monitor database query logs for unusual execution times, anomalous error rates, and suspicious parameter inputs associated with the plugin endpoints.

Compensating Controls: Deploy a Web Application Firewall (WAF) rule to inspect and block suspicious SQL injection patterns targeting the object_ids and exclude_object_ids parameters.

Public Exploit Available: No

Security teams must treat this high-severity vulnerability with urgency due to the unauthenticated nature of the attack vector. Administrators should monitor plugin vendor channels closely for patch releases and apply updates immediately to prevent potential database compromise.