CVE-2026-2416 is an SQL Injection vulnerability in the Geo Mashup plugin for WordPress affecting all versions up to 1.13.17. The issue arises from improper neutralization of special elements in the 'sort' parameter, allowing unauthenticated attackers to append additional SQL queries to existing ones. This occurs because user input is not sufficiently escaped or prepared before inclusion in SQL statements, potentially enabling extraction of sensitive database information. The vulnerability is classified under CWE-89 and has a CVSS v3.1 base score of 7.5, indicating high severity. No patch or official fix is currently documented, and the product is not a cloud service.

Successful exploitation allows unauthenticated attackers to perform SQL Injection via the 'sort' parameter, potentially extracting sensitive information from the database. The vulnerability does not impact integrity or availability directly but compromises confidentiality. There are no known active exploits in the wild as of the published date.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider disabling or restricting access to the vulnerable parameter or plugin. Monitor vendor channels for updates and apply patches promptly once available.