CVE-2026-4062
Published: 02 May 2026
Summary
CVE-2026-4062 is a high-severity SQL Injection (CWE-89) vulnerability in Wordpress (inferred from references). Its CVSS base score is 7.5 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 28.5th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 RA-5 (Vulnerability Monitoring and Scanning) and SI-10 (Information Input Validation).
Deeper analysis
CVE-2026-4062 is a time-based SQL injection vulnerability in the Geo Mashup plugin for WordPress, affecting all versions up to and including 1.13.18. The flaw arises from insufficient escaping of the user-supplied 'object_ids' and 'exclude_object_ids' parameters, combined with inadequate preparation of SQL queries. Specifically, the esc_sql() function is applied but fails to protect against injection in unquoted IN(...) or NOT IN(...) contexts, as it only escapes quotes and does not guard against parentheses or SQL keywords. Additionally, a numeric-only sanitizer in sanitize_query_args() is limited to the AJAX code path and absent from render-map.php and template tag paths, enabling injection of additional SQL queries.
Unauthenticated attackers can exploit this vulnerability remotely with low complexity and no user interaction required, as indicated by its CVSS v3.1 base score of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N). Exploitation involves appending SQL payloads to existing queries, allowing extraction of sensitive database information through time-based blind SQL injection techniques, with high confidentiality impact but no integrity or availability disruption.
References highlight vulnerable code locations, including geo-mashup-db.php at lines 1755 and 1759, and render-map.php at line 166. A patch is available in WordPress plugin changeset 3503627. Additional details on the threat are provided in Wordfence's vulnerability intelligence at the referenced URL.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-26780
Vulnerability details
The Geo Mashup plugin for WordPress is vulnerable to Time-Based SQL Injection via the 'object_ids' and 'exclude_object_ids' parameters in all versions up to, and including, 1.13.18. This is due to insufficient escaping on the user supplied parameters and lack of…
more
sufficient preparation on the existing SQL query. The `esc_sql()` function is applied but is ineffective because the values are placed in an unquoted `IN(...)` / `NOT IN(...)` SQL context — `esc_sql()` only escapes quote characters and provides no protection against parenthesis or SQL keyword injection. Additionally, while a numeric-only sanitizer exists in `sanitize_query_args()`, it is only applied in the AJAX code path and not in the `render-map.php` or template tag code paths. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database via a time-based blind approach.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
The CVE describes a remote unauthenticated SQL injection vulnerability in a public-facing WordPress plugin, directly enabling exploitation of the web application per T1190.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Requires validation of user-supplied parameters like 'object_ids' and 'exclude_object_ids' to block malicious SQL payloads, directly addressing the insufficient escaping and sanitization in unquoted IN/NOT IN contexts.
Mandates identification, reporting, and correction of flaws such as the SQL injection vulnerability in the Geo Mashup plugin, enabling application of the available patch to eliminate the issue.
Requires vulnerability scanning to identify SQL injection flaws like CVE-2026-4062 in WordPress plugins and timely remediation to prevent exploitation.