CVE-2026-6457: Geo Mashup WordPress Plugin SQLi Flaw

CVE-2026-6457 Overview

CVE-2026-6457 is a time-based blind SQL injection vulnerability in the Geo Mashup plugin for WordPress. The flaw affects all versions up to and including 1.13.19. It exists in the handling of the geo_mashup_null_fields parameter, which is passed into a database query without sufficient escaping or use of prepared statements. Authenticated attackers holding subscriber-level access or higher can append SQL clauses to the existing query and exfiltrate sensitive data from the WordPress database. The issue is tracked under CWE-89, Improper Neutralization of Special Elements used in an SQL Command.

Critical Impact

Authenticated subscribers can extract password hashes, session tokens, API keys, and other sensitive data stored in the WordPress database.

Affected Products

• Geo Mashup plugin for WordPress, all versions through 1.13.19
• WordPress sites with the plugin enabled and subscriber registration permitted
• Multisite WordPress installations using the affected plugin

Discovery Timeline

• 2026-05-02 - CVE-2026-6457 published to NVD
• 2026-05-05 - Last updated in NVD database

Technical Details for CVE-2026-6457

Vulnerability Analysis

The vulnerability is a time-based blind SQL injection. The plugin accepts the geo_mashup_null_fields parameter from authenticated requests and incorporates it into an SQL statement before that input has been escaped or bound through $wpdb->prepare(). Because no error output is returned to the client in this code path, attackers infer query results through deliberately injected timing functions such as SLEEP() or BENCHMARK(). Each conditional response is observed by measuring server response time, allowing byte-by-byte extraction of database contents.

The affected code paths are visible in the plugin source at geo-mashup-db.php line 1991, geo-mashup-ui-managers.php line 388, and geo-mashup.php line 567. The fix landed in changeset 3519909 on the plugin trunk.

Root Cause

The plugin treats the user-supplied geo_mashup_null_fields parameter as trusted input and concatenates it into an SQL statement. WordPress provides the $wpdb->prepare() API and esc_sql() helper specifically to prevent this class of bug, but neither was applied to this parameter. The result is that any string passed by the user becomes part of the SQL query syntax.

Attack Vector

Exploitation requires authentication at subscriber level or above, which is a low bar on WordPress sites that allow open registration. After authenticating, the attacker submits a crafted HTTP request that includes a malicious geo_mashup_null_fields value containing SQL syntax such as a UNION clause or a conditional SLEEP() payload. The injected SQL executes within the database context used by WordPress, granting read access to tables including wp_users and wp_options. See the Wordfence Vulnerability Report for additional analysis.

Detection Methods for CVE-2026-6457

Indicators of Compromise

• HTTP requests containing the geo_mashup_null_fields parameter with SQL keywords such as SLEEP, BENCHMARK, UNION, SELECT, or OR 1=1.
• Web server logs showing repeated requests from authenticated subscriber accounts with abnormally long server response times.
• Unexpected outbound queries against wp_users or wp_usermeta correlated with plugin endpoints.

Detection Strategies

• Inspect access logs for POST or GET requests to Geo Mashup endpoints carrying URL-encoded SQL syntax in geo_mashup_null_fields.
• Apply web application firewall (WAF) signatures targeting time-based blind SQLi patterns on WordPress admin-ajax routes.
• Enable MySQL general or slow query logging to capture queries containing SLEEP() invocations originating from the plugin.

Monitoring Recommendations

• Alert on newly created subscriber accounts followed by repeated requests to plugin endpoints within a short window.
• Track the distribution of HTTP response times per authenticated user; statistical outliers indicate time-based probing.
• Forward WordPress and database logs to a centralized analytics platform for correlation with authentication events.

How to Mitigate CVE-2026-6457

Immediate Actions Required

• Update the Geo Mashup plugin to the version released in changeset 3519909, which is the first release after 1.13.19.
• Audit WordPress user accounts and remove unused subscriber accounts; disable open registration where it is not required.
• Rotate WordPress secret keys, administrator passwords, and any API tokens stored in wp_options if compromise is suspected.

Patch Information

The vendor remediated the issue in the plugin trunk via changeset 3519909. The fix introduces proper escaping and prepared-statement handling for the geo_mashup_null_fields parameter on the affected code paths in geo-mashup-db.php, geo-mashup-ui-managers.php, and geo-mashup.php. Site administrators should upgrade to the patched release immediately.

Workarounds

• Deactivate and remove the Geo Mashup plugin until the patched version can be deployed.
• Restrict access to plugin endpoints with a WAF rule that blocks SQL metacharacters in the geo_mashup_null_fields parameter.
• Temporarily revoke subscriber-level capabilities for untrusted users and disable self-registration via the WordPress general settings.

# Configuration example: WP-CLI commands to mitigate exposure
wp plugin update geo-mashup
wp option update users_can_register 0
wp user list --role=subscriber --field=ID | xargs -I{} wp user get {}