Threats tagged 'ghsa-r8rw-2fcf-g752'

The Geo Mashup plugin for WordPress contains a time-based blind SQL Injection vulnerability in the 'geo_mashup_null_fields' parameter. This affects all versions up to and including 1.13.19. Authenticated users with subscriber-level access or higher can exploit this flaw to append additional SQL queries, potentially extracting sensitive database information. The vulnerability arises from insufficient escaping of user input and inadequate preparation of SQL queries.