The Geo Mashup plugin for WordPress up to version 1.13.18 is vulnerable to a time-based SQL injection via the 'map_post_type' parameter when the Geo Search feature is enabled. This vulnerability arises because the plugin removes WordPress magic quotes protection and concatenates unsanitized input into SQL queries without proper escaping or preparation. An unauthenticated attacker can exploit this flaw to extract sensitive database information using a time-based blind SQL injection technique.