The vulnerability occurs when the Geo Mashup plugin processes the 'map_post_type' parameter. By invoking stripslashes_deep on $_POST, the plugin removes WordPress magic quotes, and the unsanitized value is concatenated directly into an IN clause without proper escaping or preparation. An attacker can therefore inject SQL that is executed as part of a time‑based blind query, allowing the extraction of sensitive database information for users who possess no authentication. The flaw can only be exploited when the plugin’s Geo Search feature is enabled, but no authentication is required to supply a malicious request.

All WordPress sites that have the Geo Mashup plugin installed with a version equal to or earlier than 1.13.18 are affected. The plugin in question is identified by cyberhobo as Geo Mashup.

The CVSS score of 7.5 denotes high severity. No EPSS score is available, signaling that a specific exploitation probability cannot be quantified at this time. The vulnerability is not listed in CISA’s KEV catalog. Based on the fact that the flaw can be triggered through a standard HTTP request to the website, the likely attack vector is remote, unauthenticated, and requires only the ability to send an HTTP request to a target that has the plugin’s Geo Search feature enabled.