CVE-2026-4061 describes a time-based SQL injection vulnerability in the Geo Mashup WordPress plugin (up to version 1.13.18). The vulnerability arises from the 'map_post_type' POST parameter being passed through stripslashes_deep, which disables WordPress magic quotes protection, and then concatenated directly into an SQL IN clause without using esc_sql() or $wpdb->prepare(). While one code branch applies esc_sql() correctly, the vulnerable branch does not, allowing injection of additional SQL queries. Exploitation requires the Geo Search feature to be enabled and can be performed by unauthenticated attackers to extract sensitive data via time-based blind SQL injection.

Successful exploitation allows unauthenticated attackers to perform time-based blind SQL injection attacks, enabling extraction of sensitive information from the plugin's database. The vulnerability does not affect integrity or availability directly but compromises confidentiality. The CVSS 3.1 base score is 7.5 (high severity), reflecting network attack vector, low attack complexity, no privileges required, no user interaction, and high confidentiality impact.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, it is recommended to disable the Geo Search feature in the Geo Mashup plugin settings to prevent exploitation. Monitor vendor channels for updates and apply patches promptly once available.