The Geo Mashup plugin for WordPress up to and including version 1.13.18 is vulnerable to a time-based SQL injection via the 'sort' parameter. This vulnerability arises because the user-supplied 'sort' parameter is insufficiently escaped and not properly sanitized in all code paths, allowing unauthenticated attackers to inject additional SQL queries. Although a sanitizer was introduced in version 1.13.18, it only applies to AJAX requests and not to other code paths, leaving the vulnerability exploitable. The flaw enables extraction of sensitive database information through a time-based blind SQL injection technique.