CVE-2026-48967: WordPress Geo Mashup plugin <= 1.13.19 - SQL Injection vulnerability

Synopsis

This is a SQL injection vulnerability in the WordPress Geo Mashup plugin, versions 1.13.19 and earlier. The flaw is reachable over the network and requires only a low-privilege subscriber-level account, making it accessible to any registered user on an affected WordPress site. Successful exploitation reads sensitive data from the underlying database and can also cause limited service disruption. HarborGuard tracks this advisory and will make a patched-image rebuild available the moment an upstream fix is published.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The vulnerable endpoint is exposed over the network, so an attacker must be able to reach the WordPress site via HTTP or HTTPS.

• AuthenticationRequired

  A low-privilege account (subscriber level or equivalent) is sufficient; no administrative access is needed.

• Victim interactionNot required

  The attacker can trigger the SQL injection directly without any action from another user or administrator.

• Attack complexityDetail

  Attack complexity is low, meaning the exploit is reliable and does not depend on race conditions, specific memory layout, or other hard-to-control environmental factors.

Blast Radius

• An attacker reads arbitrary rows from the WordPress database, including stored user credentials, session tokens, email addresses, and plugin configuration data.
• Database confidentiality impact is rated High, meaning sensitive records across the full WordPress schema are within reach of the injected query.
• The availability impact is rated Low; crafted queries can degrade database responsiveness or cause partial service disruption for legitimate users.
• No write or delete capability is indicated by the CVSS vector, so data modification and deletion are not directly enabled by this exploit path.