EUVD-2026-37051
GHSA-8ph6-g5r7-mqc9
Severity by source
AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L
Network-reachable WordPress plugin, no auth or interaction; SQLi typically allows DB read (C:H) and limited writes via INSERT/UPDATE chaining (I:L), scope unchanged within the database authority.
Primary rating from Vendor (Patchstack).
CVSS VectorVendor: Patchstack
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L
Lifecycle Timeline
2DescriptionCVE.org
Unauthenticated SQL Injection in GEO my WordPress <= 4.5.5 versions.
Articles & Coverage 1
AnalysisAI
Unauthenticated SQL injection in the GEO my WordPress plugin versions 4.5.5 and earlier allows remote attackers to inject arbitrary SQL into backend queries against WordPress sites running the plugin. The flaw was disclosed via Patchstack, carries a CVSS 9.3 with scope change, and currently has no public exploit identified at time of analysis, though SQL injection in WordPress plugins is historically a high-value automated target.
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | No special conditions - remote unauthenticated exploitation against default installations of the GEO my WordPress plugin at version 4.5.5 or earlier, with no user interaction required per CVSS PR:N/UI:N. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.1 vector AV:N/AC:L/PR:N/UI:N indicates network-reachable, low-complexity, unauthenticated exploitation with no user interaction - the worst combination for prerequisites and a strong fit for opportunistic mass-scanning by botnets that routinely sweep WordPress installs. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker scans internet-facing WordPress sites for the GEO my WordPress plugin and sends a crafted HTTP request to a vulnerable geo-search endpoint, embedding SQL syntax in a location, distance, or filter parameter. The injection is concatenated into a backend query, allowing the attacker to extract administrator password hashes from wp_users and secret keys from wp_options without any authentication or user interaction. … |
| Remediation | Upstream fix available per Patchstack advisory; released patched version not independently confirmed in the provided data, so administrators should consult the Patchstack entry at https://patchstack.com/database/wordpress/plugin/geo-my-wp/vulnerability/wordpress-geo-my-wordpress-plugin-4-5-5-sql-injection-vulnerability and the plugin's WordPress.org listing to install the latest release above 4.5.5. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours: Audit all WordPress installations for GEO my WordPress plugin versions 4.5.5 or earlier; notify business stakeholders and activate incident response protocols. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Share
External POC / Exploit Code
Leaving vuln.today