The Geo Mashup plugin for WordPress contains an unsanitized ‘sort’ query parameter that is directly embedded into a SQL statement. This oversight permits an attacker to inject additional SQL clauses into the existing query. Because the vulnerability does not require authentication, anyone able to send a crafted HTTP request can cause the database to execute the injected statements. The result is the potential leakage of sensitive data such as user credentials, content, or configuration stored in the WordPress database.

All installations of the Geo Mashup plugin, developed by cyberhobo, running version 1.13.17 or earlier on WordPress sites are affected. The issue resides in the plugin’s database handling code and applies to any WordPress instance that has the vulnerable plugin activated.

With a CVSS score of 7.5 the vulnerability is considered a high‑severity flaw. An EPSS score of 15% indicates that a measurable portion of the environment is likely to experience exploitation attempts. The flaw is not yet listed in the CISA KEV catalog, but because authentication is not required, attackers can target the vulnerability from any external web request. A typical exploit would involve submitting a malicious ‘sort’ value in an HTTP request to the plugin’s endpoint, resulting in unauthorized read access to the database.