CVE-2026-4062: Geo Mashup WordPress Plugin SQLi Flaw

CVE-2026-4062 Overview

CVE-2026-4062 is a time-based blind SQL injection vulnerability in the Geo Mashup plugin for WordPress. The flaw affects all versions up to and including 1.13.18. Unauthenticated attackers can inject SQL through the object_ids and exclude_object_ids parameters because the plugin places user input into unquoted IN(...) and NOT IN(...) SQL clauses. The esc_sql() function only escapes quote characters, providing no defense in this context. Attackers can append additional SQL queries to extract sensitive database content using time-based blind techniques.

Critical Impact

Unauthenticated remote attackers can extract sensitive database contents from any WordPress site running Geo Mashup 1.13.18 or earlier through time-based blind SQL injection.

Affected Products

• WordPress Geo Mashup plugin versions up to and including 1.13.18
• WordPress sites using render-map.php code paths with Geo Mashup
• WordPress sites using Geo Mashup template tags that invoke geo-mashup-db.php query builders

Discovery Timeline

• 2026-05-02 - CVE-2026-4062 published to NVD
• 2026-05-05 - Last updated in NVD database

Technical Details for CVE-2026-4062

Vulnerability Analysis

The vulnerability is a classic SQL injection flaw [CWE-89] arising from incorrect use of WordPress sanitization helpers. The Geo Mashup plugin builds SQL queries that include user-supplied identifiers inside unquoted IN(...) and NOT IN(...) clauses. The plugin calls esc_sql() on these values before concatenating them into the query string. Because esc_sql() is designed to escape values placed inside quoted string literals, it does not neutralize parentheses, commas, or SQL keywords used in numeric list contexts.

An attacker supplies values for object_ids or exclude_object_ids that contain SQL fragments such as conditional SLEEP() or BENCHMARK() calls. The injected SQL is concatenated directly into the executing query, allowing the attacker to infer database content from response timing.

Root Cause

The root cause is mismatched sanitization for the SQL context. A numeric-only sanitizer in sanitize_query_args() exists in the codebase but is only invoked along the AJAX execution path. The render-map.php code path at line 166 and the template tag query builders in geo-mashup-db.php at lines 1755 and 1759 do not call this sanitizer. The plugin therefore relies on esc_sql() alone, which provides no protection in unquoted numeric list contexts.

Attack Vector

The attack vector is unauthenticated and remote over HTTP. Attackers send crafted requests to public WordPress endpoints that invoke Geo Mashup map rendering or template tags, supplying malicious values for object_ids or exclude_object_ids. The injection is blind, so attackers extract data character-by-character using timing oracles such as SLEEP() inside a CASE or IF expression.

No verified public exploit code is available. See the Wordfence Vulnerability Intel entry and the vulnerable code in geo-mashup-db.php line 1755 for technical details.

Detection Methods for CVE-2026-4062

Indicators of Compromise

• HTTP requests containing object_ids or exclude_object_ids parameters with values that include SQL keywords such as SLEEP, BENCHMARK, CASE, IF, SELECT, or UNION.
• Web server access logs showing repeated requests to Geo Mashup endpoints with incrementally varying numeric or character payloads, indicating blind SQL extraction.
• Database query logs showing unusually long execution times for queries originating from Geo Mashup code paths.

Detection Strategies

• Inspect WordPress and reverse proxy logs for query strings containing the object_ids or exclude_object_ids parameters paired with parentheses or SQL function names.
• Deploy web application firewall rules that flag time-delay function names appearing in query parameters bound to Geo Mashup endpoints.
• Correlate slow database queries with concurrent inbound HTTP requests targeting render-map.php or shortcode-rendered pages.

Monitoring Recommendations

• Monitor average and tail latency of WordPress page renders that embed Geo Mashup maps and alert on anomalous spikes.
• Track unauthenticated requests volumes to Geo Mashup endpoints and alert on sudden bursts from a single source.
• Enable MySQL slow query logging with a low threshold to capture injected SLEEP-based payloads.

How to Mitigate CVE-2026-4062

Immediate Actions Required

• Update the Geo Mashup plugin to a version that includes the fix from WordPress changeset 3503627.
• If updating immediately is not possible, deactivate the Geo Mashup plugin until the patched version is deployed.
• Review WordPress and database logs for evidence of historical exploitation against the affected parameters.

Patch Information

The vendor addressed the vulnerability in changeset 3503627, which applies proper numeric sanitization to the object_ids and exclude_object_ids parameters across all code paths, including render-map.php and template tag query builders in geo-mashup-db.php. Site administrators should install the fixed release through the WordPress plugin updater.

Workarounds

• Block requests containing object_ids or exclude_object_ids query parameters at the web application firewall when the values are not strictly numeric comma-separated lists.
• Restrict access to pages embedding Geo Mashup maps to authenticated users until the plugin is updated.
• Apply database-level least-privilege controls so the WordPress database user cannot read sensitive tables outside the plugin's required scope.

# Example ModSecurity rule blocking non-numeric values in vulnerable parameters
SecRule ARGS:object_ids|ARGS:exclude_object_ids "!@rx ^[0-9,]+$" \
    "id:1004062,phase:2,deny,status:403,\
    msg:'CVE-2026-4062 Geo Mashup SQLi attempt blocked'"