CVE-2026-103913: GeoDirectory <= 2.8.186 - Unauthenticated SQL Injection via 'latitude' Parameter via Stored Pending Listing
The GeoDirectory plugin for WordPress is vulnerable to SQL Injection via the stored latitude/longitude coordinates of a listing in versions up to, and including, 2.8.186. This is due to insufficient escaping and the absence of numeric validation on coordinate values when a listing is saved, combined with the direct string interpolation of those values into a distance sub-expression in geodirgpsquerypart() that is later executed by the public wpajaxnoprivgeodirwidgetlistings handler when a caller supplies setpost=<pending-listing-id> and sortby=distanceasc. This makes it possible for authenticated attackers, with Subscriber-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this vulnerability?
An attacker needs an authenticated WordPress account with Subscriber-level access or higher. They must be able to save a listing containing malicious latitude or longitude coordinate values.
Is the vulnerable query reachable without authentication?
Yes. The affected query is later executed through the public wp_ajax_nopriv_geodir_widget_listings handler. Exploitation requires supplying set_post with the ID of the prepared pending listing and sort_by=distance_asc.
What is the likely impact?
The issue can allow additional SQL queries to be appended to existing queries and used to extract sensitive information from the WordPress database. The provided scoring indicates high confidentiality impact, with no stated integrity or availability impact.
How can I identify potentially affected listings?
Review pending GeoDirectory listings for latitude or longitude values that are not valid numeric coordinates. Listings with unexpected text or SQL-like content in either coordinate field warrant investigation.