What is the CVSS score of CVE-2026-39512?

CVE-2026-39512 has a CVSS 3.1 base score of 9.3 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L. EPSS exploitation probability: 0.3%.

Which versions of GeoDirectory are affected by CVE-2026-39512?

GeoDirectory, a WordPress plugin used on thousands of websites, contains an unauthenticated SQL injection flaw (CVE-2026-39512, CVSS 9.3) affecting all installations on versions 2.8.152 and earlier.

How to fix or mitigate CVE-2026-39512?

Within 24 hours: Inventory all WordPress sites running GeoDirectory and confirm installed versions. Within 7 days: Deactivate and remove GeoDirectory versions ≤2.8.152 from production, or implement WAF rules and database access restrictions if the plugin is operationally critical. Within 30 days: Monitor EUVD-2026-36951 for patched versions; redeploy only after vendor releases version >2.8.152 and your team validates the fix.

GeoDirectory CVE-2026-39512

EUVD-2026-36951 CRITICAL

SQL Injection (CWE-89)

2026-06-15 Patchstack

GHSA-5cfj-2j7j-f96c

SQLi Geodirectory

9.3

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

9.3 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L

vuln.today AI

9.9 CRITICAL

Unauthenticated network-reachable SQLi gives PR:N/AV:N/AC:L; scope-change retained as DB spans components; raised I:N→I:L since SQLi typically allows some write/manipulation.

3.1 AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:L

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:L/SC:L/SI:N/SA:N

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

None

Availability

Low

Lifecycle Timeline

Analysis Generated

Jun 15, 2026 - 22:23 vuln.today

DescriptionCVE.org

Unauthenticated SQL Injection in GeoDirectory <= 2.8.152 versions.

AnalysisAI

Unauthenticated SQL injection in the GeoDirectory WordPress plugin (versions up to and including 2.8.152) allows remote attackers to inject arbitrary SQL into backend database queries without any credentials or user interaction. The flaw was disclosed via Patchstack and tracked as EUVD-2026-36951; no public exploit identified at time of analysis, and the issue is not currently listed in CISA KEV. Given the WordPress plugin ecosystem's history of rapid weaponization for SQLi flaws, this should be treated as a priority despite the absence of confirmed in-the-wild activity.

Technical ContextAI

GeoDirectory is a WordPress plugin by Paolo (CPE: cpe:2.3:a:paolo:geodirectory) that adds business directory and geolocation listing functionality to WordPress sites, exposing public-facing search, filter, and listing endpoints that query the underlying MySQL/MariaDB database. The root cause is CWE-89 (Improper Neutralization of Special Elements used in an SQL Command), meaning user-controlled input is concatenated or inadequately parameterized into SQL statements - a classic failure to use $wpdb->prepare() or proper escaping for parameters reaching a query. Because the vulnerability is reachable without authentication, the injection point is almost certainly an unauthenticated front-end endpoint (e.g., AJAX action, search/filter handler, or REST route) rather than an admin-only function.

RemediationAI

Upstream fix available per Patchstack advisory; released patched version not independently confirmed in the provided data, so administrators should upgrade GeoDirectory to the latest version above 2.8.152 published on wordpress.org or via the plugin's update channel and verify the installed version after upgrade. Consult the Patchstack advisory at https://patchstack.com/database/wordpress/plugin/geodirectory/vulnerability/wordpress-geodirectory-plugin-2-8-152-sql-injection-vulnerability for the confirmed fixed release. If immediate patching is not possible, compensating controls include deploying a WAF rule (Patchstack, Wordfence, or ModSecurity OWASP CRS) to block SQLi payloads against GeoDirectory endpoints, temporarily deactivating the plugin if directory functionality is non-critical (side effect: directory pages will 404 or lose features), restricting access to the WordPress site behind authentication or IP allowlisting for high-risk deployments, and enabling database query logging plus rotating WordPress database credentials and admin password hashes after patching in case prior exploitation occurred.