Security Alert Summary
The Geo Mashup plugin for WordPress contains an SQL injection vulnerability in the sort parameter that affects all versions up to and including 1.13.17. Insufficient escaping and lack of proper query preparation allow unauthenticated attackers to inject additional SQL into existing queries, which can be used to extract sensitive information from the database.
CVE Details
- CVE ID: CVE-2026-2416
- Affected component: Geo Mashup plugin for WordPress
- Affected versions: All versions up to and including 1.13.17
- Published: February 25, 2026 at 9:16 AM (UTC)
- Last modified: February 25, 2026 at 2:15 PM (UTC)
- CVSS v3.1: Base Score 7.5 — HIGH — Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
- Authentication / Privileges / User Interaction: Authentication: none required; Privileges Required: NONE; User Interaction: NONE
- Primary impact: Confidentiality: HIGH; Integrity: NONE; Availability: NONE
- CWE: CWE-89
Technical Details
This vulnerability is an SQL injection rooted in how a user-supplied sort parameter is handled. The plugin fails to sufficiently escape that parameter and does not properly prepare the existing SQL query, allowing an attacker to append additional SQL statements to queries executed by the plugin. The CVE entry references the plugin database code (for example, geo-mashup-db.php) where the unsafe handling occurs; see the references for the exact locations.
Because the issue allows injection via an unauthenticated request, an attacker can craft requests that modify the executed SQL to retrieve data from the database. The description does not specify particular functions or REST endpoints beyond naming the affected parameter and the database-handling code.
How This Could Impact Your Website
In a typical small- or medium-sized WordPress site, the site owner maintains administrative control, internal staff manage content and day-to-day operations, and external contractors or contributors may have limited editing access. An unauthenticated SQL injection that exposes database contents can allow an attacker to retrieve sensitive data such as user records or stored metadata.
Practical consequences include exposure of internal user email addresses or other stored details, which increases the risk of targeted phishing or social engineering against staff or contractors. The vulnerability’s impact is primarily on confidentiality; it does not, per the CVE data, indicate direct integrity or availability impacts.
If you’re unsure whether your site is affected or how to assess your current user roles and plugins, it may be worth having a professional review.
Recommended Actions
- Update the affected plugin as soon as a patched version is available.
- Review and reduce unnecessary user roles, especially contributor-level accounts.
- Enforce strong passwords and enable two-factor authentication for editors and administrators.
- Remove unused or unmaintained plugins from your site.
- Monitor site activity and database access logs for unusual behavior that could indicate exploitation.
If you’d like help reviewing your plugins, user roles, or overall WordPress security posture, our team at Freshy is happy to help.
References
- https://plugins.trac.wordpress.org/browser/geo-mashup/tags/1.13.17/geo-mashup-db.php#L1530
- https://plugins.trac.wordpress.org/browser/geo-mashup/tags/1.13.17/geo-mashup-db.php#L1701
- https://plugins.trac.wordpress.org/changeset/3461591/geo-mashup
- https://www.wordfence.com/threat-intel/vulnerabilities/id/8ab5ca55-0a8a-45a8-9ab0-aa3bbfa85417?source=cve
