CVE-2026-84813 in GeoDirectory Plugin
Summary
by MITRE • 09/03/2026
Unauthenticated SQL Injection in GeoDirectory <= 2.8.174 versions.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 09/03/2026
The vulnerability identified as an unauthenticated SQL injection within GeoDirectory versions prior to 2.8.174 represents a critical security flaw that compromises the integrity of the underlying database system. This plugin, widely used for creating location-based directories and maps on WordPress sites, processes user input from various endpoints without adequate sanitization or validation before constructing SQL queries. The absence of authentication requirements means that any external actor with network access to the target web application can exploit this flaw remotely. By manipulating specific parameters passed through HTTP requests, an attacker can inject malicious Structured Query Language code into the database backend. This capability allows for unauthorized data retrieval, modification, or deletion, effectively bypassing all intended security controls and user permissions associated with the application layer.
From a technical perspective, the root cause lies in improper neutralization of special elements used in SQL commands within one or more inputs processed by the affected software. The vulnerability typically manifests when dynamic query construction occurs without proper parameterized queries or prepared statements. Instead of treating input data as literal values, the database engine interprets injected characters such as single quotes and semicolons as structural components of the SQL syntax itself. This misinterpretation enables an attacker to alter the logic of the original query. For instance, by appending a union-based injection payload, an adversary can extract sensitive information from other tables within the same database schema, including user credentials, administrative hashes, or proprietary business data stored in the WordPress database. The lack of input validation on these specific endpoints creates a direct attack vector that is both reliable and easy to exploit using standard automated tools.
The operational impact of this vulnerability extends far beyond simple data leakage. An attacker with sufficient privileges derived from successful SQL injection can often escalate their access to achieve remote code execution, depending on the database configuration and permissions granted to the web application user account. In many WordPress environments, the database user has broad privileges that may allow writing files to the server or executing system commands via specific database functions like mysql_query in older MySQL versions or similar constructs in MariaDB. This escalation path transforms a data-centric vulnerability into a full system compromise. Furthermore, the integrity of the application is severely undermined as attackers can modify directory listings, inject malicious links into public-facing content, or deface the website by altering post and page contents directly through database manipulation.
This flaw aligns with Common Weakness Enumeration identifier CWE-89, which classifies Improper Neutralization of Special Elements used in an SQL Command. It also maps to MITRE ATT&CK techniques related to Database Query Injection, specifically under the Initial Access or Collection tactics depending on whether it is used for gaining entry or exfiltrating data. The unauthenticated nature of this exploit places it among the most dangerous categories of web application vulnerabilities because it requires no prior interaction with a legitimate user account. Security researchers and penetration testers frequently utilize such flaws to demonstrate critical risks in content management systems, highlighting the necessity for rigorous input validation and secure coding practices during development.
Mitigation strategies must prioritize immediate patching as the primary defense vector. Administrators running GeoDirectory versions up to 2.8.174 should upgrade to version 2.8.175 or later where these specific injection points have been secured with proper escaping mechanisms and prepared statements. In scenarios where immediate updating is not feasible due to compatibility constraints, temporary mitigations include implementing a Web Application Firewall configured with rulesets designed to detect SQL injection patterns in HTTP parameters. Additionally, enforcing strict input validation on all user-supplied data at the application level can reduce the attack surface. Regular security audits and code reviews focusing on database interaction layers are essential to prevent similar vulnerabilities from being introduced in future updates or custom extensions developed for the platform.