CVE-2026-85705: Location Manager <= 2.3.38 - Unauthenticated SQL Injection via 'latitude' and 'longitude' REST API Parameters
The Location Manager plugin for WordPress is vulnerable to generic SQL Injection via 'latitude' and 'longitude' REST API Parameters in all versions up to, and including, 2.3.38 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. The injection is triggered when the orderby=latlon parameter is supplied, and affects multiple publicly accessible REST endpoints including geodir/v2/locations/cities, /regions, /countries, and /neighbourhoods via both the getlocations() and getneighbourhoods() functions.
Affected Software
Event History
Frequently Asked Questions
Which deployments are exposed to this issue?
WordPress sites using the Location Manager plugin version 2.3.38 or earlier are affected. The vulnerable functionality is exposed through publicly accessible REST endpoints for cities, regions, countries, and neighbourhoods.
Does an attacker need an account or user interaction to exploit it?
No. The issue is unauthenticated and can be exploited remotely without user interaction, provided the attacker can reach the affected REST endpoints.
What request conditions trigger the vulnerable query path?
The attacker supplies the latitude and longitude REST parameters together with orderby=lat_lon. The affected paths include geodir/v2/locations/cities, /regions, /countries, and /neighbourhoods, through the get_locations() and get_neighbourhoods() functions.
What is the likely impact if exploitation succeeds?
An attacker can append SQL to existing queries and extract sensitive information from the WordPress database. The provided severity vector indicates high confidentiality impact, with no indicated integrity or availability impact.