CVE-2026-6457 describes a time-based blind SQL Injection vulnerability in the Geo Mashup plugin for WordPress, affecting all versions up to 1.13.19. The issue arises from improper neutralization of special elements in the 'geo_mashup_null_fields' parameter, allowing authenticated users with subscriber-level privileges or higher to inject additional SQL commands. This occurs due to insufficient escaping of user input and lack of proper query preparation, enabling attackers to extract sensitive data from the database without requiring higher privileges or user interaction.

Successful exploitation allows an authenticated user with subscriber-level access or above to perform time-based blind SQL Injection attacks, potentially extracting sensitive information from the backend database. The vulnerability does not impact data integrity or availability directly but compromises confidentiality. There are no known exploits in the wild at this time.

No official patch or remediation is currently available. Users should monitor the vendor's advisory channels for updates. Until a fix is released, restricting subscriber-level access or disabling the Geo Mashup plugin may reduce risk. Avoid granting unnecessary privileges to users and consider additional application-layer protections such as web application firewalls that can detect SQL injection attempts.