CVE-2026-103913: GeoDirectory <= 2.8.186 - Unauthenticated SQL Injection via 'latitude' Parameter via Stored Pending Listing

Q: Who can exploit this vulnerability?

An attacker needs an authenticated WordPress account with Subscriber-level access or higher. They must be able to save a listing containing malicious latitude or longitude coordinate values.

Q: Is the vulnerable query reachable without authentication?

Yes. The affected query is later executed through the public wp_ajax_nopriv_geodir_widget_listings handler. Exploitation requires supplying set_post with the ID of the prepared pending listing and sort_by=distance_asc.

Q: What is the likely impact?

The issue can allow additional SQL queries to be appended to existing queries and used to extract sensitive information from the WordPress database. The provided scoring indicates high confidentiality impact, with no stated integrity or availability impact.

Q: How can I identify potentially affected listings?

Review pending GeoDirectory listings for latitude or longitude values that are not valid numeric coordinates. Listings with unexpected text or SQL-like content in either coordinate field warrant investigation.

Published Oct 3, 2026

Updated

The GeoDirectory plugin for WordPress is vulnerable to SQL Injection via the stored latitude/longitude coordinates of a listing in versions up to, and including, 2.8.186. This is due to insufficient escaping and the absence of numeric validation on coordinate values when a listing is saved, combined with the direct string interpolation of those values into a distance sub-expression in geodirgpsquerypart() that is later executed by the public wpajaxnoprivgeodirwidgetlistings handler when a caller supplies setpost=<pending-listing-id> and sortby=distanceasc. This makes it possible for authenticated attackers, with Subscriber-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.

Affected Software

1 affected component

GeoDirectory GeoDirectory<=2.8.186

Event History

Oct 3, 2026

CVE Published

via MITRE·05:29 AM

Data Sourced

via MITRE·05:29 AM

DescriptionSeverityWeakness

Data Sourced

via NVD·06:16 AM

DescriptionSeverityWeakness

Frequently Asked Questions

Who can exploit this vulnerability?

An attacker needs an authenticated WordPress account with Subscriber-level access or higher. They must be able to save a listing containing malicious latitude or longitude coordinate values.

Is the vulnerable query reachable without authentication?

Yes. The affected query is later executed through the public wp_ajax_nopriv_geodir_widget_listings handler. Exploitation requires supplying set_post with the ID of the prepared pending listing and sort_by=distance_asc.

What is the likely impact?

The issue can allow additional SQL queries to be appended to existing queries and used to extract sensitive information from the WordPress database. The provided scoring indicates high confidentiality impact, with no stated integrity or availability impact.

How can I identify potentially affected listings?

Review pending GeoDirectory listings for latitude or longitude values that are not valid numeric coordinates. Listings with unexpected text or SQL-like content in either coordinate field warrant investigation.

CVE-2026-103913: GeoDirectory <= 2.8.186 - Unauthenticated SQL Injection via 'latitude' Parameter via Stored Pending Listing

Affected Software

Event History

Frequently Asked Questions

Who can exploit this vulnerability?

Is the vulnerable query reachable without authentication?

What is the likely impact?

How can I identify potentially affected listings?

Company

Resources

Contact

Frequently Asked Questions

Who can exploit this vulnerability?

Is the vulnerable query reachable without authentication?

What is the likely impact?

How can I identify potentially affected listings?