CVE-2026-6457 describes a time-based blind SQL Injection vulnerability in the Geo Mashup WordPress plugin (versions up to 1.13.19). The vulnerability arises from insufficient escaping of the 'geo_mashup_null_fields' parameter and lack of proper SQL query preparation. Authenticated attackers with subscriber-level privileges or above can append malicious SQL to existing queries, potentially extracting sensitive data from the database. There is no vendor-provided patch or official remediation at this time. The CVSS 3.1 base score is 6.5, reflecting network attack vector, low attack complexity, and limited privileges required.

Successful exploitation allows an authenticated user with subscriber-level access or higher to perform time-based blind SQL Injection attacks. This can lead to unauthorized disclosure of sensitive database information. The vulnerability does not impact integrity or availability according to the CVSS vector, but confidentiality is rated high. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, limit subscriber-level access to trusted users and consider disabling or removing the Geo Mashup plugin if feasible. Monitor vendor channels for updates regarding patches or mitigations.