CVE-2026-103913 in GeoDirectory Plugin
Summary
by MITRE • 10/03/2026
The GeoDirectory plugin for WordPress is vulnerable to SQL Injection via the stored latitude/longitude coordinates of a listing in versions up to, and including, 2.8.186. This is due to insufficient escaping and the absence of numeric validation on coordinate values when a listing is saved, combined with the direct string interpolation of those values into a distance sub-expression in geodir_gps_query_part() that is later executed by the public wp_ajax_nopriv_geodir_widget_listings handler when a caller supplies set_post=<pending-listing-id> and sort_by=distance_asc. This makes it possible for authenticated attackers, with Subscriber-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 10/03/2026
The GeoDirectory plugin for WordPress presents a critical security vulnerability in versions up to 2.8.186, characterized by a stored SQL injection flaw within its geolocation functionality. This weakness stems directly from insufficient input sanitization and validation mechanisms applied when users save listing data containing latitude and longitude coordinates. The core technical failure lies in the absence of strict numeric validation for these coordinate values, allowing attackers to inject malicious payloads that are subsequently persisted into the database rather than being rejected at the point of entry.
The exploitation mechanism relies on a specific sequence involving direct string interpolation within the geodir_gps_query_part function. When an authenticated user with Subscriber-level access or higher saves a listing, they can embed SQL code within the geographic coordinate fields. This malicious data is stored without modification and later retrieved during query execution. The vulnerability becomes exploitable when a caller triggers the public wp_ajax_nopriv_geodir_widget_listings handler by supplying specific parameters, namely set_post pointing to the compromised listing ID and sort_by set to distance_asc. At this stage, the system interpolates the unvalidated coordinate string directly into an SQL query used for calculating distances between listings.
This architectural flaw allows authenticated attackers to append additional SQL queries to existing legitimate statements. Because the injection occurs via stored data that is later executed in a public-facing context without proper authentication checks on the handler itself, the impact extends beyond simple database corruption. Attackers can leverage this vector to extract sensitive information from the underlying database, including user credentials, personal identifiable information, and other proprietary site data. The combination of stored persistence and execution in an unauthenticated endpoint significantly amplifies the risk profile of this vulnerability.
From a classification perspective, this issue aligns with CWE-89 Improper Neutralization of Special Elements used in an SQL Command due to insufficient escaping or validation of user-supplied input. Furthermore, it maps to ATT&CK technique T1059 Command and Scripting Interpreter through the indirect execution of database commands via web application parameters. The vulnerability also reflects aspects of CWE-20 Improper Input Validation regarding the failure to enforce data type constraints on numeric fields like geographic coordinates.
Mitigation strategies must prioritize immediate patching to version 2.8.187 or later where these validation checks have been strengthened. In environments where upgrading is not immediately feasible, administrators should implement strict input filtering at the application layer to ensure that coordinate fields accept only valid numerical values with appropriate decimal precision. Additionally, deploying a Web Application Firewall can help detect and block attempts to inject SQL syntax into geolocation parameters before they reach the vulnerable code path. Regular security audits focusing on database interaction patterns are recommended to identify similar vulnerabilities in other plugins or custom themes utilizing geographic data processing features.