CVE-2026-4060: Geo Mashup WordPress Plugin SQLi Flaw

CVE-2026-4060 Overview

CVE-2026-4060 is a time-based blind SQL injection vulnerability in the Geo Mashup plugin for WordPress. The flaw affects all versions up to and including 1.13.18 and is reachable through the sort parameter. Unauthenticated attackers can append arbitrary SQL to existing queries and extract sensitive data from the WordPress database.

The issue stems from improper handling of user input in an ORDER BY clause. The plugin applies esc_sql(), but that function does not protect unquoted identifiers, leaving the query exploitable. The vulnerability is classified under CWE-89 (SQL Injection).

Critical Impact

Unauthenticated remote attackers can exfiltrate database contents — including user credentials and session data — through time-based blind SQL injection against any WordPress site running the Geo Mashup plugin.

Affected Products

• Geo Mashup plugin for WordPress, all versions up to and including 1.13.18
• WordPress sites using the render-map.php code path
• WordPress sites using Geo Mashup template tag code paths

Discovery Timeline

• 2026-05-02 - CVE-2026-4060 published to NVD
• 2026-05-05 - Last updated in NVD database

Technical Details for CVE-2026-4060

Vulnerability Analysis

The vulnerability exists in the database query logic of the Geo Mashup plugin. The sort parameter is incorporated into an ORDER BY clause within the query construction performed in geo-mashup-db.php around lines 1767 and 1785. Because ORDER BY accepts column identifiers rather than quoted string literals, the value is interpolated into the SQL statement without surrounding quotes.

The plugin calls esc_sql() on the input, but this WordPress sanitizer escapes characters that would break out of quoted string contexts. With no quotes present, the escaping has no protective effect, and an attacker can inject SQL syntax directly. The maintainers added an allowlist sanitizer named sanitize_sort_arg() in version 1.13.18, but the patch was incomplete. The sanitizer is invoked only by sanitize_query_args() along the AJAX path, leaving render-map.php (line 166) and template tag entry points still vulnerable.

Exploitation does not require authentication and proceeds through normal HTTP requests. Attackers use time-based payloads — typically constructs that conditionally invoke SLEEP() — to infer query results from response latency. Because the injection point sits inside ORDER BY, payloads commonly leverage CASE expressions or subqueries to trigger the delay.

Root Cause

The root cause is the use of an ineffective sanitizer for the SQL context. esc_sql() is designed for quoted string literals and does not neutralize identifiers or expressions used in ORDER BY. The corrective control, sanitize_sort_arg(), enforces an allowlist of valid sort column names but is wired into only one of multiple code paths that consume the sort parameter.

Attack Vector

A remote, unauthenticated attacker sends an HTTP request to a page or endpoint that renders a Geo Mashup map with a controllable sort parameter. The attacker substitutes a time-based blind SQL injection payload for the parameter value. The server executes the modified query, and response delay reveals one bit of database content per request. Iterative requests reconstruct full column values such as wp_users.user_pass hashes.

The injection occurs in the render-map.php rendering flow and template tag flow, neither of which receives the new allowlist sanitization. See the WordPress Plugin Code Reference and the Wordfence Vulnerability Analysis for additional technical detail.

Detection Methods for CVE-2026-4060

Indicators of Compromise

• HTTP requests containing the sort parameter with SQL keywords such as SLEEP, BENCHMARK, CASE WHEN, or IF( targeting Geo Mashup endpoints
• Web server access logs showing repeated similar requests to map-rendering URLs with incrementing payload variants — a hallmark of blind SQLi enumeration
• Database query logs showing ORDER BY clauses containing functions or subqueries instead of plain column names
• Sustained elevated response times on pages embedding Geo Mashup maps from a single source IP

Detection Strategies

• Inspect web access logs for sort= query string values that contain non-alphanumeric characters, parentheses, or SQL function names
• Enable MySQL slow query logging and review entries where ORDER BY operands include SLEEP, BENCHMARK, or nested SELECT statements
• Deploy web application firewall (WAF) rules that match SQL injection patterns specifically in the sort parameter
• Correlate request rate anomalies with elevated database CPU or query latency on hosts running vulnerable plugin versions

Monitoring Recommendations

• Inventory all WordPress installations and identify those running Geo Mashup at version 1.13.18 or earlier
• Alert on outbound traffic from web hosts to unfamiliar destinations following suspicious inbound sort parameter activity
• Monitor wp_users and wp_options table read patterns for unusual access volume from the WordPress application user

How to Mitigate CVE-2026-4060

Immediate Actions Required

• Identify all WordPress sites running Geo Mashup version 1.13.18 or earlier and prioritize remediation
• Apply a patched release as soon as it is available from the plugin maintainers; track the WordPress Plugin Changeset for fix progress
• Deploy WAF rules blocking SQL keywords and metacharacters in the sort parameter against vulnerable endpoints
• Rotate WordPress administrator passwords and any secrets stored in wp_options if exploitation indicators are present

Patch Information

At publication, version 1.13.18 introduced sanitize_sort_arg() but applied it only to the AJAX path through sanitize_query_args(). A complete fix must extend the allowlist sanitizer to render-map.php and template tag execution paths. Site operators should monitor the Wordfence Vulnerability Analysis for confirmation of a fully remediated release.

Workarounds

• Deactivate and remove the Geo Mashup plugin until a complete patch is published
• If the plugin must remain active, restrict access to map-rendering pages with authentication or IP allowlisting
• Add WAF signatures that reject any sort parameter value not matching a strict alphanumeric allowlist
• Apply database-level least privilege so the WordPress user cannot read sensitive tables outside wp_* if not needed

# Example WAF rule (ModSecurity) blocking suspicious sort parameter values
SecRule ARGS:sort "!@rx ^[A-Za-z_]+(\s+(ASC|DESC))?$" \
    "id:1004060,phase:2,deny,status:403,\
     msg:'CVE-2026-4060 Geo Mashup sort parameter SQLi attempt',\
     logdata:'sort=%{MATCHED_VAR}'"