The Geo Mashup plugin for WordPress contains an unauthenticated time‑based SQL injection flaw in the 'object_ids' and 'exclude_object_ids' parameters in all versions up to 1.13.18. The flaw arises because values supplied by a user are placed in an IN/NOT IN clause without proper quoting or parameter binding, allowing an attacker to inject additional SQL statements. Since the optional numeric sanitizer is only applied in the AJAX path, the template and render‑map code paths remain vulnerable. If exploited, the attack can retrieve confidential database data by inducing delayed responses that reveal the existence of data through timing.

The vulnerability affects installations of the Geo Mashup WordPress plugin produced by cyberhobo. All releases with a version number less than or equal to 1.13.18 are impacted. Users running those versions on any WordPress site are at risk.

The CVSS score of 7.5 indicates a high severity. The EPSS score is currently unavailable, and the vulnerability is not listed in the CISA KEV catalog, so the measured exploitation probability is unknown. Attackers do not need authentication to submit the malicious parameters, making the attack vector network‑based and public. An attacker can craft a payload that forces the database to wait, such as adding a sleep function, and measure the response time to infer data. Because the flaw resides in a database query, success requires interaction with the target's MySQL (or MariaDB) backend, but no special privileges are required beyond the database credentials used by WordPress itself.