CVE-2026-4060 describes a time-based SQL injection vulnerability in the Geo Mashup WordPress plugin by cyberhobo affecting all versions up to and including 1.13.18. The issue arises from improper neutralization of special elements in the 'sort' parameter used in SQL commands. The esc_sql() function is applied but is ineffective in the ORDER BY clause context because the parameter is not enclosed in quotes. A whitelist sanitizer was added in version 1.13.18 but only for the AJAX code path, leaving other code paths vulnerable to injection. This allows unauthenticated attackers to append SQL queries and extract sensitive data via time-based blind SQL injection.

An unauthenticated attacker can exploit this vulnerability to perform time-based blind SQL injection attacks, potentially extracting sensitive information from the database. The vulnerability does not affect data integrity or availability directly but compromises confidentiality. The CVSS score of 7.5 (High) reflects the network attack vector, no privileges required, and high impact on confidentiality.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. The existing partial fix in version 1.13.18 applies sanitization only to AJAX code paths and does not fully mitigate the vulnerability in other code paths. Users should monitor for an official patch that applies proper sanitization across all affected code paths. Until then, consider disabling or restricting access to vulnerable functionality if possible.