CVE-2026-4061 Overview
CVE-2026-4061 is a time-based blind SQL injection vulnerability in the Geo Mashup plugin for WordPress, affecting all versions up to and including 1.13.18. The flaw resides in the SearchResults hook, where unauthenticated attackers can inject SQL through the map_post_type parameter. Successful exploitation lets attackers extract sensitive database contents using time-based inference techniques. Exploitation requires the Geo Search feature to be enabled in plugin settings, but no authentication or user interaction is required.
Critical Impact
Unauthenticated attackers can extract sensitive database contents, including user credentials and configuration data, from any WordPress site running Geo Mashup ≤ 1.13.18 with Geo Search enabled.
Affected Products
- Geo Mashup plugin for WordPress, versions ≤ 1.13.18
- WordPress installations with the Geo Search feature enabled
- Any site exposing the plugin's SearchResults endpoint to unauthenticated visitors
Discovery Timeline
- 2026-05-02 - CVE-2026-4061 published to NVD
- 2026-05-05 - Last updated in NVD database
Technical Details for CVE-2026-4061
Vulnerability Analysis
The vulnerability is a classic SQL injection ([CWE-89]) caused by the plugin removing WordPress's input-protection layer and then concatenating attacker-controlled data directly into a SQL query. The SearchResults hook explicitly invokes stripslashes_deep($_POST), stripping the magic-quotes-style escaping that WordPress applies to superglobals. The cleaned map_post_type value is then placed inside an IN(...) clause without any subsequent sanitization.
Because the query executes server-side and reflects no output, attackers exploit it as a time-based blind injection. They submit payloads containing SLEEP() or BENCHMARK() constructs and infer data values from response delays. This allows incremental extraction of database records such as wp_users hashes and secret keys.
Root Cause
The root cause is inconsistent sanitization across code branches in the plugin's search logic. The 'any' branch correctly applies array_map('esc_sql', ...) to the post-type list before building the IN(...) clause. The else branch handling specific post-type values omits this call and bypasses $wpdb->prepare() entirely, allowing raw user input to reach the query.
Attack Vector
An unauthenticated remote attacker sends a crafted POST request to the plugin's search endpoint with a malicious map_post_type parameter. The payload breaks out of the IN(...) clause and appends a conditional time-delay expression. The attacker measures HTTP response timing to extract data one bit at a time. Refer to the Wordfence Vulnerability Report and the WordPress Plugin Code Review for the vulnerable source.
No verified public proof-of-concept code is available. The vulnerable code path is documented in the plugin source at geo-mashup-db.php line 1748 and php/Search.php line 152.
Detection Methods for CVE-2026-4061
Indicators of Compromise
- POST requests to Geo Mashup search endpoints containing map_post_type values with SQL keywords such as SLEEP, BENCHMARK, UNION, or SELECT.
- Web server access logs showing repeated requests from the same source with consistent multi-second response times, indicative of time-based extraction.
- Unusual MySQL SLOW_QUERY_LOG entries originating from the WordPress database user that reference the wp_posts table with anomalous IN(...) clauses.
Detection Strategies
- Inspect HTTP request bodies at the WAF or reverse proxy for SQL metacharacters in the map_post_type parameter.
- Correlate slow HTTP responses (>5s) with requests to URIs that invoke the plugin's SearchResults handler.
- Monitor MySQL query patterns for IN(...) clauses containing concatenated boolean or time-delay expressions.
Monitoring Recommendations
- Enable verbose logging on the WordPress site and forward logs to a centralized analytics platform for query pattern analysis.
- Alert on outbound database response anomalies and unexpected query volume from the WordPress application user.
- Track plugin file integrity and version metadata to detect unpatched installations.
How to Mitigate CVE-2026-4061
Immediate Actions Required
- Update the Geo Mashup plugin to a version newer than 1.13.18 containing the fix from WordPress Changeset 3503627.
- If patching is not immediately possible, disable the Geo Search feature in the plugin settings to remove the vulnerable code path.
- Deploy a Web Application Firewall (WAF) rule blocking SQL metacharacters in the map_post_type POST parameter.
Patch Information
The plugin maintainers addressed the issue in WordPress Changeset 3503627. The fix applies esc_sql() to the map_post_type value in the previously vulnerable branch, matching the sanitization already present in the 'any' branch. Site administrators should apply the corresponding plugin update through the WordPress admin dashboard.
Workarounds
- Disable the Geo Mashup plugin entirely until the update is deployed.
- Restrict access to the WordPress search endpoint via IP allowlisting at the network edge.
- Apply database-level least-privilege so the WordPress MySQL user cannot read sensitive tables outside its required scope.
# Configuration example: WAF rule pattern (ModSecurity-style)
SecRule ARGS:map_post_type "@rx (?i)(sleep|benchmark|union|select|--|;|/\*)" \
"id:1004061,phase:2,deny,status:403,msg:'CVE-2026-4061 Geo Mashup SQLi attempt'"
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
