WordPress Geo Mashup SQL Injection via Unvalidated POST Parameters

The Geo Mashup plugin for WordPress is vulnerable to Time-Based SQL Injection via the 'map_post_type' parameter in all versions up to, and including, 1.13.18. This is due to the `SearchResults` hook explicitly calling `stripslashes_deep($_POST)` which removes WordPress magic quotes protection, followed by the unsanitized `map_post_type` value being concatenated into an `IN(...)` clause without `esc_sql()` or `$wpdb->prepare()`. The 'any' branch of the same code correctly applies `array_map('esc_sql', ...)`, but the else branch does not. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database via a time-based blind approach. Exploitation requires the Geo Search feature to be enabled in plugin settings.

Casky was already ahead

This CVE exploits attack patterns that Casky's 301matched skills have been training on — long before this vulnerability was disclosed. Claude's reasoning model maps these techniques to MITRE ATT&CK, so practitioners who ran these skills have already seen the threat behaviour in their findings.

Analysis

The Geo Mashup WordPress plugin contains a critical SQL injection vulnerability in versions up to 1.13.18 affecting the 'map_post_type' parameter. By removing WordPress's built-in magic quotes protection through `stripslashes_deep($_POST)` and then concatenating unsanitized user input directly into database queries without using `esc_sql()` or `$wpdb->prepare()`, attackers can inject malicious SQL commands. This vulnerability impacts any WordPress installation using the vulnerable plugin, allowing unauthenticated attackers to execute arbitrary SQL queries, extract sensitive data, modify or delete database records, and potentially achieve remote code execution. The flaw is particularly dangerous because it bypasses WordPress's standard security mechanisms intentionally, creating a direct pipeline from user input to the database.

Casky's 301 mapped skills detect the attack patterns associated with TA0001 (Initial Access) and TA0043 (Reconnaissance) through Claude AI's extended reasoning capabilities. When practitioners analyze suspicious activity, Casky identifies the characteristic SQL injection signatures: POST requests containing SQL keywords and syntax in the 'map_post_type' parameter, unusual database query patterns in logs, and time-based blind SQL injection indicators such as deliberate response delays (UNION-based and Boolean-based payloads would appear in request logs). The platform highlights the specific weakness—the interaction between `stripslashes_deep()` and the missing database escaping functions—enabling practitioners to understand not just that exploitation occurred, but the exact code path attackers traversed. Practitioners will see findings correlating suspicious POST parameters with database activity spikes and unauthorized data access attempts, allowing them to pinpoint compromised WordPress instances and trace attacker reconnaissance and initial access efforts.

301 Casky skills cover this attack pattern

These skills use Claude AI's reasoning model to surface findings in the same attack categories as CVE-2026-4061.

analyzing-apt-group-with-mitre-navigator

threat intelligence · low

Run

analyzing-campaign-attribution-evidence

threat intelligence · low

Run

analyzing-certificate-transparency-for-phishing

threat intelligence · low

Run

MITRE ATT&CK Techniques

TA0001 TA0043

Practise detecting this in the Casky Playground

Run Claude AI skills against real targets and see findings like those behind CVE-2026-4061 — before the next CVE drops.

Join the Playground Waitlist →

X Instagram LinkedIn