The Geo Mashup plugin for WordPress is vulnerable to a time‑based blind SQL injection that can be triggered through the untrusted 'sort' parameter. The flaw stems from insufficient escaping and a context‑mismatch: the esc_sql() function is applied, but because the value is used in an ORDER BY clause without quotes, malicious SQL is not filtered. This allows an attacker to append additional SQL statements to the existing query and leverage timing delays to infer data from the database.

All installations of the Geo Mashup plugin version 1.13.18 or earlier are impacted. The vulnerability exists in the render‑map.php and template tag code paths, which are widely used in WordPress sites that employ this plugin.

The flaw can be exploited by anyone with network access to the WordPress site, without authentication. The CVSS score of 7.5 signals a high severity. Although the EPSS score is not available and the vulnerability is not listed in CISA KEV, the nature of the attack—unauthenticated, remote content‑based—makes it a significant data‑exposure risk. An attacker can craft a time‑based payload, send requests to the vulnerable endpoint, and observe response latency to enumerate database contents.