WordPress Geo Mashup Plugin Time-Based SQL Injection

The Geo Mashup plugin for WordPress is vulnerable to Time-Based SQL Injection via the 'sort' parameter in all versions up to, and including, 1.13.18. This is due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. The `esc_sql()` function is applied but is ineffective in the `ORDER BY` context because the value is not enclosed in quotes. Additionally, while a `sanitize_sort_arg()` allowlist-based sanitizer was added in version 1.13.18, it is only applied in the AJAX code path (`sanitize_query_args()`) and not in the `render-map.php` or template tag code paths. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database via a time-based blind approach.

Casky was already ahead

This CVE exploits attack patterns that Casky's 301matched skills have been training on — long before this vulnerability was disclosed. Claude's reasoning model maps these techniques to MITRE ATT&CK, so practitioners who ran these skills have already seen the threat behaviour in their findings.

Analysis

The Geo Mashup plugin for WordPress contains a time-based SQL injection vulnerability in the 'sort' parameter affecting versions through 1.13.18. This vulnerability exists because the `esc_sql()` function, while present, fails to protect against SQL injection in an ORDER BY context where values must be quoted to be properly escaped. The vulnerability allows unauthenticated attackers to execute arbitrary SQL queries, potentially leading to unauthorized data extraction, modification, or deletion from the WordPress database. Given the widespread adoption of WordPress and plugins, this affects organizations of all sizes using vulnerable versions of Geo Mashup, making it a significant risk across diverse sectors.

Casky's 301 mapped security skills detect the attack patterns associated with this vulnerability by identifying the underlying MITRE ATT&CK techniques: TA0001 (Initial Access) through parameter injection vectors and TA0043 (Reconnaissance) activities used to probe for vulnerable endpoints. Claude AI's extended reasoning capability enables practitioners to recognize the characteristic signatures of time-based SQL injection—such as unusual query delays, parameter manipulation in sort fields, and database timing anomalies—while also identifying the root cause: insufficient input validation despite the presence of ineffective escaping functions. Practitioners using Casky would see detailed findings highlighting the improper use of `esc_sql()` in ORDER BY clauses, the need for allowlist-based sanitization like `sanitize_sort_arg()`, and the attack chain from unauthenticated parameter injection through to potential data exfiltration.

301 Casky skills cover this attack pattern

These skills use Claude AI's reasoning model to surface findings in the same attack categories as CVE-2026-4060.

analyzing-apt-group-with-mitre-navigator

threat intelligence · low

Run

analyzing-campaign-attribution-evidence

threat intelligence · low

Run

analyzing-certificate-transparency-for-phishing

threat intelligence · low

Run

MITRE ATT&CK Techniques

TA0001 TA0043

Practise detecting this in the Casky Playground

Run Claude AI skills against real targets and see findings like those behind CVE-2026-4060 — before the next CVE drops.

Join the Playground Waitlist →

X Instagram LinkedIn