CVE-2026-4060

HIGH

Geo Mashup <= 1.13.18 - Unauthenticated Time-Based SQL Injection via 'sort' Parameter

Title source: CVE List
Search associated code STIX 2.1 vulnerability STIX 2.1 with PoCs

Record summary

CVE-2026-4060 has a selected CVSS score of 7.5 (high); EIP currently links 1 repository PoC and 1 lab environment.

Description

The Geo Mashup plugin for WordPress is vulnerable to Time-Based SQL Injection via the 'sort' parameter in all versions up to, and including, 1.13.18. This is due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. The `esc_sql()` function is applied but is ineffective in the `ORDER BY` context because the value is not enclosed in quotes. Additionally, while a `sanitize_sort_arg()` allowlist-based sanitizer was added in version 1.13.18, it is only applied in the AJAX code path (`sanitize_query_args()`) and not in the `render-map.php` or template tag code paths. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database via a time-based blind approach.

Description source: CVE List

Exploitation context

Available material

Repository PoCs
1
Lab environments
1

CISA SSVC decision

ExploitationNone
AutomatableYes
Technical impactPartial

CISA Coordinator · SSVC 2.0.3 · Evaluated May 4, 2026 · Source: CVE List

Affected products and versions

1
ProductSourceVersion range

Geo Mashup

Browse cyberhobo / Geo Mashup

Default status: unaffected

CVE ListThrough 1.13.18affected

Proofs of concept

1

Repository PoCs

GitHubydking0911/CVE-2026-4060-PoCRepository PoCby ydking09110Scanner9 files

1.6 MiB

GitHub
PoC details
Analysisdeepseek-v4-pro:cloud ·

Technical assessment

The artifact is a Nuclei detection template and supporting documentation for CVE-2026-4060. It checks for the presence of a vulnerable Geo Mashup plugin version and then sends a time-based SQL injection payload to confirm the vulnerability via response delay, without extracting data.

Backdoor review

No backdoor observed in reviewed code

The supplied evidence consists of a README.md documentation file and a Nuclei detection template (CVE-2026-4060.yaml). The README describes a legitimate SQL injection proof-of-concept for CVE-2026-4060, including setup instructions, test results, and mitigation. The Nuclei template contains standard detection logic with no concealed or deceptive behavior. No backdoor, trojan, or suspicious payload is present in the reviewed text.

ClassificationScanner
Model confidence95%
AuthenticationNot required
LanguagesYAMLMarkdown
Target softwareGeo Mashup WordPress Plugin
Attack typesSQL Injection (Time-Based Blind)
Evidence & reasoningClassification basis · observed behavior · safety review
Technical evidence

Classification basis and observed behavior

Classification basis

The primary artifact is a Nuclei template (nuclei/CVE-2026-4060.yaml) that detects the vulnerability by checking the plugin version and confirming a time delay from a SLEEP injection. It does not extract data or exploit the vulnerability beyond confirming its presence. The README.md describes a separate Python PoC (poc.py) for data extraction, but that file is not included in the supplied evidence.

nuclei/CVE-2026-4060.yaml:1-70README.md:119-130

Requirements

  • Target must have Geo Mashup plugin version <= 1.13.18 installed and active.nuclei/CVE-2026-4060.yaml:47-52
  • The target's render-map endpoint must be accessible and return a response containing 'GeoMashup.createMap'.nuclei/CVE-2026-4060.yaml:64-69

Observed behavior

  • Sends an HTTP GET request to /wp-content/plugins/geo-mashup/readme.txt to extract the plugin's stable version and checks if it is <= 1.13.18.nuclei/CVE-2026-4060.yaml:34-54
  • If the version check passes, sends a second HTTP GET request to the render-map endpoint with a SLEEP(8) SQL injection payload in the sort parameter.nuclei/CVE-2026-4060.yaml:56-63
  • Matches the response if the status code is 200, the body contains 'GeoMashup.createMap', and the request duration is >= 8 seconds, indicating a successful time-based SQL injection.nuclei/CVE-2026-4060.yaml:64-70
Safety-review evidence

Behaviors behind the backdoor verdict

Observables

Url
Payload withheldExample SQL injection payload targeting a local test environment, consistent with the described vulnerability.README.md:114
Url
Payload withheldNuclei template payload targeting the same local test endpoint for vulnerability detection.nuclei/CVE-2026-4060.yaml:59
Review boundaries

What the analysis did not establish

  • The Python PoC script (poc.py) referenced in README.md for data extraction is not included in the supplied evidence. Only the Nuclei scanner template and README documentation are provided.
  • The evidence packet reports complete_artifact_coverage is false, indicating not all files from the repository are included.
  • Binary files (e.g., screenshots) are flagged as metadata only and were not analyzed.
  • Only two text files (README.md and nuclei/CVE-2026-4060.yaml) were reviewed. Seven other files (including 4 non-text media files and 3 unclassified files) were omitted from the evidence packet and not analyzed. The complete artifact coverage is false, so backdoor behavior in unexamined files cannot be ruled out.
Model interpretation

This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.

Docker lab environments

1
GitHub

docker-compose.yml

ydking0911/CVE-2026-4060-PoCCreated Vuln labCVE-2026-4060Compose · images

1 Compose manifest · 3 services

View exploit
Analysisdeepseek-v4-pro:cloud ·

Environment assessment

A Docker Compose environment running WordPress 6.8.2 with MariaDB 11.4 and the vulnerable Geo Mashup 1.13.18 plugin, designed to demonstrate CVE-2026-4060, an unauthenticated time-based blind SQL injection.

docker-compose.yml:1-50README.md:1-275

Lab assessment

Vulnerability lab

The README explicitly describes CVE-2026-4060, provides a PoC script, and the Compose file sets up a specific vulnerable version of the Geo Mashup plugin (1.13.18) on WordPress. The environment is structured to reproduce and test the SQL injection vulnerability.

README.md:1-3docker-compose.yml:44
Lab shapeCompose · images
Services3
Compose manifests1
Dockerfiles0
Evidence & reasoningComponents · CVE assessment · exercise context · review boundaries
Components

Services and files described by the evidence

db

database server

MariaDB 11.4 container providing the WordPress database. It is configured with a root password, a dedicated WordPress user, and a healthcheck.

docker-compose.yml:2-14

wordpress

web application servervulnerable target

WordPress 6.8.2 with Apache and PHP 8.2, exposing port 8080 on the host. It depends on the db service and mounts a volume for persistent data. The vulnerable Geo Mashup plugin is installed by the cli service.

docker-compose.yml:16-30

cli

setup automation

A WordPress CLI container that runs a one-time setup script to install WordPress, install and activate the vulnerable Geo Mashup 1.13.18 plugin, and create a geo-tagged post. It runs as user 33:33 and exits after completion.

docker-compose.yml:32-44

poc.py

exploit script

A Python script that checks for the Geo Mashup plugin, confirms the SQL injection via a SLEEP payload, and extracts database version, name, and user using time-based blind SQLi.

poc.py:1-147

setup.sh

lab orchestration

A shell script that starts the Docker Compose environment, waits for it to be ready, and prints instructions for running the PoC.

setup.sh:1-18
CVE assessment

How the supplied evidence relates each vulnerability

CVE-2026-4060

Supported by supplied evidence

The README, PoC script, and Compose setup all target CVE-2026-4060. The environment installs the vulnerable plugin version (1.13.18) and the PoC demonstrates time-based blind SQL injection via the sort parameter, consistent with the CVE description.

README.md:1-3poc.py:1-6docker-compose.yml:44
Exercise context

Requirements and sequence described by the evidence

Prerequisites

  • Docker and Docker Compose must be installed to run the lab environment.README.md:89-91
  • Python 3 is required to run the PoC script.README.md:67
  • The lab must be started with setup.sh or docker compose up, and the WordPress site must be accessible at http://localhost:8080.setup.sh:4-5README.md:100-101

Evidence-described exercise path

  1. Clone the repository and start the lab environment using setup.sh, which launches the containers and configures the vulnerable plugin.README.md:89-91setup.sh:4-5
  2. Confirm the SQL injection vulnerability by sending a SLEEP payload via curl to the vulnerable endpoint and observing a ~8-second delay.README.md:103-107
  3. Run the PoC script (poc.py) to extract database information (version, name, user) using time-based blind SQLi.README.md:109-117
  4. Optionally run the Nuclei detection template to confirm the vulnerability.README.md:119-121
  5. Tear down the lab with docker compose down -v.README.md:123-125
Safety-review evidence

Behaviors behind the stored safety assessment

No harmful behavior observed

All visible behavior is directed at the lab's own WordPress target. The PoC extracts database information from the lab's MariaDB container, which is expected for demonstrating the SQL injection vulnerability. No evidence of host escape, external connections, persistence, credential theft, or destructive actions beyond the lab scope was found.

poc.py:1-147docker-compose.yml:1-50setup.sh:1-18
Review boundaries

What the analysis did not establish

  • The Nuclei template file (nuclei/CVE-2026-4060.yaml) is listed in the file inventory but its content is not included in the evidence packet, so its behavior cannot be assessed.
  • Screenshot files are present but uninspected; they are not needed for the analysis.
  • The packet does not include the actual WordPress or MariaDB images, only their declarations; no runtime behavior beyond the provided scripts can be confirmed.
Model interpretation

This review is limited to the supplied lab evidence packet. It does not assert that the environment runs, reproduces a vulnerability, or is safe to execute. Contract: eip-docker-lab-analysis-v1.

Packet coverage: some source evidence omitted

References

5