rootpwn

high · CVSS v3 7.5

CVE-2026-103913

The GeoDirectory plugin for WordPress is vulnerable to SQL injection via latitude/longitude coordinates. Attackers with Subscriber-level acc

Overview

The GeoDirectory plugin for WordPress is vulnerable to SQL injection via latitude/longitude coordinates. Attackers with Subscriber-level access can inject SQL when saving listings, potentially extracting sensitive data. This affects all versions up to 2.8.186.

Description

The GeoDirectory plugin for WordPress is vulnerable to SQL Injection via the stored latitude/longitude coordinates of a listing in versions up to, and including, 2.8.186. This is due to insufficient escaping and the absence of numeric validation on coordinate values when a listing is saved, combined with the direct string interpolation of those values into a distance sub-expression in geodir_gps_query_part() that is later executed by the public wp_ajax_nopriv_geodir_widget_listings handler when a caller supplies set_post= and sort_by=distance_asc. This makes it possible for authenticated attackers, with Subscriber-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.

Impact

Confidentiality: attackers can read arbitrary database tables. Integrity: potential data tampering. Availability: not directly impacted but could lead to resource exhaustion. Defenders: WordPress site owners and administrators.

Remediation

Upgrade GeoDirectory to 2.8.187 or later. If upgrade not possible, restrict wp_ajax_nopriv_geodir_widget_listings to authenticated users only, or disable the widget. Ensure input validation for latitude/longitude and use prepared statements.

Risk context

Severity high, CVSS 7.5. No EPSS data. Defenders should treat as high priority patch.

Affected products

  • WordPress GeoDirectory plugin
  • WordPress

Scores

Severity
high
CVSS v2
7.8
CVSS v3
7.5
CVSS v4
—
EPSS
—

SQL Injection WordPress GeoDirectory Privilege Escalation Data Exfiltration High Severity

← All CVEs

Related CVEs

high

CVE-2026-104912

MISP before v2.5.48 has an authorization flaw in correlation handling during attribute searches. Correlated attributes and events can be authorized using a stale distribution snapshot instead of the live event access control list. This matters because restricted or unpublished events may remain visible to authenticated users who no longer have permission.

View analysis

high

CVE-2026-94544

CVE-2026-94544 exposes a cache sharing flaw in Next.js 16.3.0‑16.3.8 that allows unauthenticated users to see unpublished draft content or see published content in draft mode. The vulnerability arises when Cache Components or experimental.useCache are enabled and cached functions return draft‑dependent data. It can lead to accidental disclosure of sensitive content on public sites.

View analysis

high

CVE-2026-104433

Mooncake Transfer Engine versions prior to 0.3.12 contain an out‑of‑bounds read in the readString function that can be triggered by an unauthenticated attacker sending a zero‑length handshake frame. The flaw causes the service to crash, potentially disrupting SGLang inference servers or other applications using the engine. It is a high‑severity vulnerability that can lead to denial of service.

View analysis

high

CVE-2026-104476

Backdrop CMS versions prior to 1.35.1 expose configuration export archives that remain on the server. An unauthenticated attacker can download these archives and view full site configuration, including sensitive settings. This vulnerability can leak administrative credentials and other secrets.

View analysis