EUVD-2026-39675
GHSA-rprv-mwvc-g7cw
Severity by source
AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L
Unauthenticated network SQLi (AV:N/AC:L/PR:N/UI:N) yields high DB confidentiality (C:H) and possible limited writes (I:L); I keep S:U absent evidence the injection crosses a security authority, unlike the vendor's S:C.
Primary rating from Vendor (patchstack).
CVSS VectorVendor: patchstack
Lifecycle Timeline
1DescriptionCVE.org
Unauthenticated SQL Injection in GeoDirectory <= 2.8.162 versions.
AnalysisAI
SQL injection in the GeoDirectory WordPress plugin (versions up to and including 2.8.162) allows remote unauthenticated attackers to inject malicious SQL into backend queries, per Patchstack. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) with PR:N indicates exploitation requires no authentication, and the scope-changed, high-confidentiality rating (S:C/C:H) points to database disclosure beyond the plugin's own data. No public exploit identified at time of analysis, and the flaw is not listed in CISA KEV.
Technical ContextAI
GeoDirectory is a WordPress plugin used to build geographic business/listing directories, which stores listing, location, and review data in the WordPress MySQL/MariaDB database. CWE-89 (Improper Neutralization of Special Elements used in an SQL Command) is the root cause: user-controllable input reaches a SQL query without proper parameterization or sanitization (e.g., missing use of WordPress's $wpdb->prepare()), letting an attacker alter query logic. Because WordPress plugins share the single site database, an injection in one plugin can expose core tables such as wp_users (including password hashes) and wp_options (including secrets/API keys), consistent with the S:C/C:H rating in the supplied vector. The exact affected CPE was not provided in the input; affected scope is defined by the vendor as 'GeoDirectory <= 2.8.162'.
RemediationAI
No vendor-released patch version was identified in the supplied data; the advisory only defines the affected range as <= 2.8.162, so the immediate action is to upgrade GeoDirectory to the next release published after 2.8.162 that the vendor designates as fixed - confirm the exact patched version via the Patchstack advisory (https://patchstack.com/database/wordpress/plugin/geodirectory/vulnerability/wordpress-geodirectory-plugin-2-8-162-sql-injection-vulnerability?_s_id=cve) and the official WordPress.org plugin changelog before deploying. As compensating controls until patched: deploy a WAF with SQL-injection rule sets (Patchstack/Wordfence virtual patching) in front of the site to filter injection payloads (trade-off: rule tuning may cause false positives on legitimate directory searches); if the affected functionality is non-essential, deactivate the GeoDirectory plugin (trade-off: directory features go offline); and restrict/monitor access to the plugin's public listing and search endpoints, while taking a database backup and reviewing DB query logs for anomalous SELECT/UNION activity (trade-off: monitoring is detective, not preventive). Avoid relying on input filtering alone as it is easily bypassed.
More in Wordpress Plugin
View allThe Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
The Hash Form - Drag & Drop Form Builder plugin for WordPress is vulnerable to arbitrary file uploads due to missing fil
Authentication bypass in the LiteSpeed Cache WordPress plugin (versions prior to 6.5.0.1) allows unauthenticated remote
The Simple File List plugin for WordPress through version 4.2.2 contains an unauthenticated remote code execution vulner
The SureTriggers WordPress plugin through version 1.0.82 contains a privilege escalation vulnerability that allows unaut
The Ninja Forms plugin before 2.9.42.1 for WordPress allows remote attackers to conduct PHP object injection attacks via
The Business Directory Plugin - Easy Listing Directories for WordPress plugin for WordPress is vulnerable to time-based
SQL injection in the NotificationX WordPress plugin (versions up to and including 2.8.2) allows unauthenticated remote a
The POST SMTP Mailer - Email log, Delivery Failure Notifications and Best Mail SMTP for WordPress plugin for WordPress i
The MasterStudy LMS WordPress Plugin - for Online Courses and Education plugin for WordPress is vulnerable to union base
The Email Subscribers by Icegram Express plugin for WordPress is vulnerable to SQL Injection via the ‘hash’ parameter in
Remote code execution in the WP Query Console WordPress plugin (versions up to and including 1.0) by Ajit Bohra allows u
Same weakness CWE-89 – SQL Injection
View allShare
External POC / Exploit Code
Leaving vuln.today