CVE-2026-4061
Published: 02 May 2026
Summary
CVE-2026-4061 is a high-severity SQL Injection (CWE-89) vulnerability in Wordpress (inferred from references). Its CVSS base score is 7.5 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 28.5th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).
Deeper analysis
CVE-2026-4061 is a Time-Based SQL Injection vulnerability (CWE-89) affecting the Geo Mashup plugin for WordPress in all versions up to and including 1.13.18, published on 2026-05-02 with a CVSS v3.1 base score of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N). The flaw occurs in the SearchResults hook due to an explicit call to stripslashes_deep($_POST), which bypasses WordPress magic quotes protection, followed by the unsanitized map_post_type parameter being directly concatenated into an SQL IN clause without esc_sql() or $wpdb->prepare() sanitization. The any branch of the code properly applies array_map('esc_sql', ...), but the else branch omits this protection.
Unauthenticated attackers can exploit the vulnerability via the map_post_type parameter, provided the Geo Search feature is enabled in plugin settings. By crafting payloads, attackers can append additional SQL queries to existing ones, enabling extraction of sensitive database information through time-based blind SQL injection techniques.
Advisories and references, including Wordfence threat intelligence and WordPress plugin trac code browsers, detail the issue at specific lines such as geo-mashup-db.php#L1748, Hooks/SearchResults.php#L39, and Search.php#L152, with a patch available in changeset 3503627.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-26779
Vulnerability details
The Geo Mashup plugin for WordPress is vulnerable to Time-Based SQL Injection via the 'map_post_type' parameter in all versions up to, and including, 1.13.18. This is due to the `SearchResults` hook explicitly calling `stripslashes_deep($_POST)` which removes WordPress magic quotes protection,…
more
followed by the unsanitized `map_post_type` value being concatenated into an `IN(...)` clause without `esc_sql()` or `$wpdb->prepare()`. The 'any' branch of the same code correctly applies `array_map('esc_sql', ...)`, but the else branch does not. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database via a time-based blind approach. Exploitation requires the Geo Search feature to be enabled in plugin settings.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
The CVE describes an unauthenticated SQL injection in a public-facing WordPress plugin that allows direct database queries and data extraction, mapping to exploitation of public-facing applications (T1190) and data from databases (T1213.006).
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly remediates the SQL injection vulnerability by applying the available patch to the Geo Mashup plugin's SearchResults hook.
Requires validation and sanitization of the unsanitized 'map_post_type' parameter before concatenation into SQL IN clauses, preventing injection payloads.
Boundary protection via web application firewalls can inspect and block SQL injection attempts targeting the 'map_post_type' parameter at web interfaces.