WordPress Geo Mashup Plugin SQL Injection via Unquoted Parameters

The Geo Mashup plugin for WordPress is vulnerable to Time-Based SQL Injection via the 'object_ids' and 'exclude_object_ids' parameters in all versions up to, and including, 1.13.18. This is due to insufficient escaping on the user supplied parameters and lack of sufficient preparation on the existing SQL query. The `esc_sql()` function is applied but is ineffective because the values are placed in an unquoted `IN(...)` / `NOT IN(...)` SQL context — `esc_sql()` only escapes quote characters and provides no protection against parenthesis or SQL keyword injection. Additionally, while a numeric-only sanitizer exists in `sanitize_query_args()`, it is only applied in the AJAX code path and not in the `render-map.php` or template tag code paths. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database via a time-based blind approach.

Casky was already ahead

This CVE exploits attack patterns that Casky's 301matched skills have been training on — long before this vulnerability was disclosed. Claude's reasoning model maps these techniques to MITRE ATT&CK, so practitioners who ran these skills have already seen the threat behaviour in their findings.

Analysis

The Geo Mashup plugin for WordPress contains a time-based SQL injection vulnerability affecting all versions through 1.13.18. Attackers can exploit the 'object_ids' and 'exclude_object_ids' parameters to inject malicious SQL code, potentially leading to unauthorized data access, modification, or deletion. This vulnerability is particularly concerning because WordPress powers over 43% of all websites, making Geo Mashup users—including small businesses, publishers, and mapping-dependent applications—attractive targets. The root cause stems from improper use of the `esc_sql()` function, which only escapes quotes but fails to protect values placed in unquoted SQL contexts like `IN(...)` clauses, rendering the escaping mechanism ineffective against injection attacks.

Casky's 301 mapped security skills enable detection of the underlying attack patterns through Claude AI's extended reasoning across MITRE ATT&CK techniques TA0001 (Reconnaissance) and TA0043 (Reconnaissance via probing for parameter validation weaknesses). Practitioners using Casky would observe findings related to SQL injection patterns: database query anomalies from time-based detection methods (measuring response delays to infer boolean conditions), suspicious parameter manipulation in web application logs, and potential outbound database exfiltration attempts. The platform's skills would correlate parameter fuzzing activities, unusual SQL syntax in request payloads, and time-delay indicators to surface this specific vulnerability pattern, enabling teams to identify compromised Geo Mashup installations and prioritize patching before exploitation occurs.

301 Casky skills cover this attack pattern

These skills use Claude AI's reasoning model to surface findings in the same attack categories as CVE-2026-4062.

analyzing-apt-group-with-mitre-navigator

threat intelligence · low

Run

analyzing-campaign-attribution-evidence

threat intelligence · low

Run

analyzing-certificate-transparency-for-phishing

threat intelligence · low

Run

MITRE ATT&CK Techniques

TA0001 TA0043

Practise detecting this in the Casky Playground

Run Claude AI skills against real targets and see findings like those behind CVE-2026-4062 — before the next CVE drops.

Join the Playground Waitlist →

X Instagram LinkedIn