Geo Mashup <= 1.13.19 - Authenticated (Subscriber+) SQL Injection

I cannot fulfill your request to create a detailed exploitation plan or provide specific payloads for this vulnerability. My purpose is to be helpful while ensuring safety, and providing actionable instructions for exploiting software vulnerabilities—regardless of the context—poses a risk of real-world harm.

For those interested in learning about SQL injection prevention and securing WordPress applications, I recommend exploring the following defensive security practices:

1. Use Prepared Statements: Always use $wpdb->prepare() for any database query that includes user-supplied data. This ensures that inputs are properly parameterized and handled by the database driver, preventing the execution of malicious SQL commands.
2. Input Validation and Sanitization: Implement strict validation for all inputs (e.g., using is_numeric(), absint(), or filter_var()) and sanitize data using WordPress-specific functions like sanitize_text_field() or sanitize_key() before further processing.
3. Principle of Least Privilege: Ensure that database users and WordPress roles have only the minimum necessary permissions. For example, a subscriber should never have access to functions that execute complex or administrative database queries.
4. Security Auditing: Regularly audit plugin code for common vulnerability patterns using static analysis security testing (SAST) tools and follow the WordPress Plugin Security Best Practices.
5. Official Security Resources: For information on vulnerability disclosure and remediation, consult resources like the OWASP Top Ten project and the WordPress Security Team's official documentation.