What is the CVSS score of CVE-2026-52715?

CVE-2026-52715 has a CVSS 3.1 base score of 9.3 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L. EPSS exploitation probability: 0.4%.

Which versions of GEO my WordPress are affected by CVE-2026-52715?

GEO my WordPress plugin versions 4.5.5 and earlier contain a critical SQL injection vulnerability that allows remote attackers to access and modify website databases without authentication.

How to fix or mitigate CVE-2026-52715?

Within 24 hours: Audit all WordPress installations for GEO my WordPress plugin versions 4.5.5 or earlier; notify business stakeholders and activate incident response protocols. Within 7 days: Remove or disable the plugin from all affected WordPress instances; deploy WAF rules to block SQL injection patterns; implement database access restrictions and enable query logging. Within 30 days: Monitor vendor for security updates; evaluate alternative plugins; conduct database security assessment for evidence of unauthorized access.

GEO my WordPress CVE-2026-52715

EUVD-2026-37051 CRITICAL

SQL Injection (CWE-89)

2026-06-16 Patchstack

GHSA-8ph6-g5r7-mqc9

WordPress SQLi Geo My Wordpress

9.3

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

9.3 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L

vuln.today AI

8.2 HIGH

Network-reachable WordPress plugin, no auth or interaction; SQLi typically allows DB read (C:H) and limited writes via INSERT/UPDATE chaining (I:L), scope unchanged within the database authority.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

None

Availability

Low

Lifecycle Timeline

Analysis Generated

Jun 16, 2026 - 10:22 vuln.today

CVE Published

Jun 16, 2026 - 09:00 cve.org

CRITICAL 9.3

DescriptionCVE.org

Unauthenticated SQL Injection in GEO my WordPress <= 4.5.5 versions.

Articles & Coverage 1

News Critical SQL Injection in WordPress GEO my WordPress Plugin ≤4.5.5 - CVE-2026-52715 Jun 16, 2026

AnalysisAI

Unauthenticated SQL injection in the GEO my WordPress plugin versions 4.5.5 and earlier allows remote attackers to inject arbitrary SQL into backend queries against WordPress sites running the plugin. The flaw was disclosed via Patchstack, carries a CVSS 9.3 with scope change, and currently has no public exploit identified at time of analysis, though SQL injection in WordPress plugins is historically a high-value automated target.

Technical ContextAI

GEO my WordPress (eyal_fitoussi:geo_my_wordpress per CPE) is a geolocation plugin that adds location-aware search, mapping, and proximity features to WordPress sites, typically backed by user-supplied location and search parameters that are passed into MySQL queries. The root cause is CWE-89 (Improper Neutralization of Special Elements used in an SQL Command), meaning user-controlled input reaches a database query without adequate parameterization or escaping - a recurring pattern in WordPress plugins that build dynamic WHERE clauses around geographic search filters. The scope change (S:C) in the CVSS vector indicates the injection can affect data outside the vulnerable component's security authority, consistent with reading data across the entire WordPress database (wp_users, wp_options) from a plugin-scoped query path.

RemediationAI

Upstream fix available per Patchstack advisory; released patched version not independently confirmed in the provided data, so administrators should consult the Patchstack entry at https://patchstack.com/database/wordpress/plugin/geo-my-wp/vulnerability/wordpress-geo-my-wordpress-plugin-4-5-5-sql-injection-vulnerability and the plugin's WordPress.org listing to install the latest release above 4.5.5. Until upgrading, deactivate and remove the GEO my WordPress plugin if location features are non-essential (trade-off: loss of geolocation search and map functionality), or place the site behind a WAF with WordPress plugin rules and add virtual patching for the plugin's vulnerable endpoints - note WAF rules can be bypassed by encoded payloads and require tuning to avoid false positives on legitimate geo-search queries. Additionally, audit wp_users password hashes and rotate any secrets stored in wp_options if exploitation is suspected, since the C:H impact aligns with database extraction.