The Geo Mashup WordPress plugin accepts the geo_mashup_null_fields parameter without proper escaping, enabling a time-based blind SQL injection that lets an attacker append and execute arbitrary SQL queries. This flaw can be exploited by authenticated users with subscriber-level access or higher to extract sensitive information from the WordPress database.

The vulnerability affects the Geo Mashup plugin supplied by cyberhobo for WordPress. All released versions up to and including 1.13.19 are impacted. Users running the plugin on their sites must check their version and upgrade if necessary.

The CVSS score of 6.5 indicates moderate to high severity. The EPSS score is not available and the vulnerability is not listed in CISA’s KEV catalog, so no documented exploitation is known. The attack vector is authenticated, requiring a subscriber‑level account or higher, and the threat is the ability to inject and execute additional SQL statements to read sensitive data from the database.