GeoDirectory <= 2.8.186 - Authenticated (Subscriber+) SQL Injection via Listing Latitude and Longitude
- ID
- WPSEC-2026-0348
- Plugin
- GeoDirectory – WP Business Directory Plugin and Classified Listings Directory (geodirectory)
- Affected
- all versions before 2.8.187
- Remediation
- Update to 2.8.187 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
- Weakness
- CWE-89
- Usage
- Plugin Low · Affected versions Low among sites WPSec scans, 2026-10-22
- Attack surface
- GeoDirectory on WPSec AttackSurface
- Fix released
- Published
Also published later by Wordfence as CVE-2026-103913, on 2026-10-02.
Description
The GeoDirectory plugin for WordPress is vulnerable to SQL Injection via the listing latitude and longitude fields in all versions up to, and including, 2.8.186. This is due to the coordinates being saved with only sanitize_text_field() and later interpolated unquoted into the distance calculation of the listings query, without numeric validation or query preparation, when listings are sorted by distance from that listing. This makes it possible for authenticated attackers, with subscriber-level access and above who can submit listings, to append additional SQL to existing queries and extract sensitive information from the database.
References
- https://wpsec.com/vuln/WPSEC-2026-0348/
- https://plugins.svn.wordpress.org/geodirectory/tags/2.8.187/
- https://wordpress.org/plugins/geodirectory/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS