{"id":"CVE-2026-103913","published":"2026-10-03T06:16:41.800","lastModified":"2026-10-06T15:04:52.637","description":"The GeoDirectory plugin for WordPress is vulnerable to SQL Injection via the stored latitude/longitude coordinates of a listing in versions up to, and including, 2.8.186. This is due to insufficient escaping and the absence of numeric validation on coordinate values when a listing is saved, combined with the direct string interpolation of those values into a distance sub-expression in geodir_gps_query_part() that is later executed by the public wp_ajax_nopriv_geodir_widget_listings handler when a caller supplies set_post=<pending-listing-id> and sort_by=distance_asc. This makes it possible for authenticated attackers, with Subscriber-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.","cvssScore":7.5,"cvssSeverity":"HIGH","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","cwes":["CWE-89"],"vendors":[],"products":[],"references":[{"url":"https://plugins.trac.wordpress.org/browser/geodirectory/tags/2.8.185/includes/class-geodir-ajax.php#L1464","tags":[]},{"url":"https://plugins.trac.wordpress.org/browser/geodirectory/tags/2.8.185/includes/class-geodir-post-data.php#L660","tags":[]},{"url":"https://plugins.trac.wordpress.org/browser/geodirectory/tags/2.8.185/includes/general-functions.php#L1312","tags":[]},{"url":"https://plugins.trac.wordpress.org/browser/geodirectory/tags/2.8.185/includes/general-functions.php#L1394","tags":[]},{"url":"https://plugins.trac.wordpress.org/browser/geodirectory/tags/2.8.185/includes/widgets/class-geodir-widget-listings.php#L862","tags":[]},{"url":"https://plugins.trac.wordpress.org/changeset?reponame=&old=3723536%40geodirectory&new=3723536%40geodirectory","tags":[]},{"url":"https://www.wordfence.com/threat-intel/vulnerabilities/id/54f449f4-0a22-45c7-8a3b-9121d70b5fe4?source=cve","tags":[]}],"exploitRefs":[],"hasPoc":false,"ai":{"summary":"The GeoDirectory WordPress plugin contains a SQL injection vulnerability in versions up to 2.8.186 where stored latitude/longitude coordinates are not properly escaped, allowing attackers to inject malicious SQL into distance calculation queries. This enables authenticated users with subscriber-level access or higher to extract sensitive database information.","exploitability":"Exploitation requires an authenticated user with subscriber privileges who can create or modify listings with geolocation data, and then trigger the vulnerable wp_ajax_nopriv_geodir_widget_listings endpoint with specific parameters to execute the injected SQL.","blast_radius":"The vulnerability affects all WordPress sites using GeoDirectory plugin version 2.8.186 or earlier, potentially exposing sensitive user data, configuration settings, and other database contents to authenticated attackers who can manipulate listing coordinates.","remediation":"Upgrade to version 2.8.187 or later to remediate this SQL injection vulnerability.","detection":"No reliable host or network indicator is derivable from the published description.","tags":["sql-injection","wordpress","geodirectory","authenticated"],"model":"garnet-coder","analyzedAt":"2026-10-12T09:00:23.810Z"}}