CVE-2026-4061 is a time-based blind SQL injection vulnerability in the Geo Mashup WordPress plugin (up to version 1.13.18). The vulnerability occurs in the 'map_post_type' POST parameter processed by the SearchResults hook. The plugin calls stripslashes_deep on $_POST, removing WordPress magic quotes protection, then concatenates the unsanitized 'map_post_type' value into an SQL IN clause without using esc_sql() or $wpdb->prepare() in one code branch. This allows unauthenticated attackers to append additional SQL queries, enabling extraction of sensitive data via time-based blind techniques. Exploitation requires the Geo Search feature to be enabled. The CVSS 3.1 base score is 7.5 (High), reflecting network attack vector, no privileges required, no user interaction, and high confidentiality impact.

Successful exploitation allows unauthenticated attackers to extract sensitive information from the WordPress database via time-based blind SQL injection. The vulnerability impacts confidentiality but does not affect integrity or availability. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, it is recommended to disable the Geo Search feature in the Geo Mashup plugin settings to prevent exploitation. Avoid exposing the vulnerable parameter to untrusted input. Monitor vendor channels for updates and apply patches promptly once available.