EUVD-2026-82763
GHSA-jvcr-7q46-jqm3
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessIdentify site running Location Manager plugin
-
DeliverySend REST request to geodir/v2/locations with orderby=lat_lon
-
ExploitInject SQL via latitude/longitude parameter
-
ExecutionAppend UNION query to existing statement
-
ImpactExtract credentials and sensitive data from database
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization Parameterized queries, prepared statements
MITRE ATT&CK
2 techniques across 2 tactics: Initial Access, Persistence The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires that the Location Manager plugin (version <=2.3.38) is installed and active on a WordPress site, and that the attacker supplies the orderby=lat_lon parameter alongside a malicious latitude or longitude value to one of the publicly accessible REST endpoints (geodir/v2/locations/cities, /regions, /countries, or /neighbourhoods). No authentication, no user interaction, and no non-default configuration are needed - the vulnerable REST routes and the get_locations()/get_neighbourhoods() code paths are reachable in a default install. The only practical limiter is that the site must run this specific premium GeoDirectory add-on. |
| Impact | This is a genuine high-priority issue. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N = 7.5) describes a network-reachable, low-complexity, unauthenticated SQL injection requiring no user interaction - the classic profile for automated mass-scanning of WordPress plugins. The C:H/I:N/A:N impact is consistent with the description's stated goal of extracting sensitive database information (e.g., user credentials, session data) rather than modifying data, so the score is well-calibrated rather than inflated. No EPSS score, no CISA KEV entry, and no public POC are present in the provided data, so exploitation status is 'no public exploit identified at time of analysis' - but absence of these signals is common for freshly disclosed WordPress plugin flaws and does NOT lower the underlying exploitability, which the CVSS AC:L/PR:N vector rates as trivial. The main real-world mitigator is deployment footprint: Location Manager is a paid GeoDirectory add-on, so the installed base is modest. No conflicting signals were found between the vector and the description; both agree on unauthenticated network reachability. |
| Exploit ScenarioDerived | An unauthenticated attacker sends a crafted GET request to a public REST endpoint such as /wp-json/geodir/v2/locations/cities with orderby=lat_lon and malicious SQL embedded in the latitude or longitude parameter. Because the values are neither escaped nor bound in a prepared statement, the attacker appends UNION/subquery clauses to exfiltrate data such as user emails and password hashes from wp_users. No public exploit code is referenced in the provided data, but the injection is directly reachable and low-complexity. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 18, 2026
Unauthenticated SQL injection in the Location Manager plugin for WordPress allows remote attackers to read arbitrary data from the underlying database. Every installation running version 2.3.38 or earlier is exposed, because the publicly reachable REST routes geodir/v2/locations/cities, /regions, /countries and /neighbourhoods pass the 'latitude' and 'longitude' parameters into SQL through the get_locations() and get_neighbourhoods() functions without escaping or query preparation whenever orderby=lat_lon is supplied. No authentication, user interaction, or non-default configuration is needed, giving the issue a CVSS 3.1 base score of 7.5 with high confidentiality impact; no public exploit code has been identified at time of analysis and there is no evidence of active exploitation.
RemediationAI
Patch status: no vendor-released patch version is identified in the available data, so the fixed release has not been independently confirmed - check the Wordfence advisory (https://www.wordfence.com/threat-intel/vulnerabilities/id/f0ada9b6-a27c-4336-8550-99294c119a88?source=cve) and the vendor product page (https://wpgeodirectory.com/downloads/location-manager/) for an updated Location Manager build that supersedes 2.3.38 and apply it as soon as it is published. Until a patch is verified, the most effective control is to deactivate the Location Manager plugin if location listing functionality is not essential; the trade-off is loss of GeoDirectory location search and neighbourhood/city browsing. If the feature must stay online, block unauthenticated access to the affected routes - for example with a reverse-proxy, WAF or web-server rule rejecting any request matching /wp-json/geodir/v2/locations/(cities|regions|countries|neighbourhoods) that carries an orderby=lat_lon parameter, or denying non-numeric values in latitude/longitude on those paths; legitimate numeric coordinates used by public search will continue to work, but non-numeric or SQL-looking input will be blocked and any custom client sending non-numeric coordinates will break. A generic SQLi signature ruleset on the latitude/longitude parameters offers additional coverage, though it can produce false positives against unusual but legitimate coordinate formats. Because exploitation requires no authentication, apply these controls at the perimeter rather than relying on role-based restrictions, and monitor access logs for orderby=lat_lon requests with suspicious parameter content as an indicator of attempted exploitation.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The flaw is a classic CWE-89 SQL injection in a WordPress plugin REST surface. Location Manager is a GeoDirectory add-on (CPE cpe:2.3:a:ayecode_ltd:location_manager) that registers custom REST routes under the WordPress REST API namespace geodir/v2, exposing location search endpoints such as /locations/cities, /locations/regions, /locations/countries and /locations/neighbourhoods. The 'latitude' and 'longitude' query parameters are accepted by get_locations() and get_neighbourhoods() and, when the caller also sets orderby=lat_lon, are interpolated directly into a database query built with the WordPress $wpdb abstraction rather than being passed through $wpdb->prepare() with bound placeholders. Because the parameters are neither cast to numeric types nor escaped, attacker-controlled text becomes part of the SQL statement, permitting UNION/boolean-style append attacks that read data from arbitrary tables reachable by the WordPress database user. The CVSS vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) confirms this is a network-reachable, unauthenticated, low-complexity information-disclosure issue with no integrity or availability component, which is consistent with read-only extraction of credentials, user records, and other sensitive content stored in the WordPress database.
Know when Location Manager gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Unauthenticated network-reachable REST injection with no interaction gives AV:N/AC:L/PR:N/UI:N; described impact is data extraction only, so C:H with I:N/A:N.
Primary rating from Vendor (Wordfence).
CVSS VectorVendor: Wordfence
DescriptionCVE.org
The Location Manager plugin for WordPress is vulnerable to generic SQL Injection via 'latitude' and 'longitude' REST API Parameters in all versions up to, and including, 2.3.38 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. The injection is triggered when the orderby=lat_lon parameter is supplied, and affects multiple publicly accessible REST endpoints including geodir/v2/locations/cities, /regions, /countries, and /neighbourhoods via both the get_locations() and get_neighbourhoods() functions.
Executive ViewAI
The Location Manager plugin for WordPress, in all versions up to and including 2.3.38, contains a SQL injection flaw in its publicly reachable REST location endpoints that lets an attacker read arbitrary data from the site's database. Any organization hosting a WordPress site with this plugin is exposed, and because no vendor patch is currently available, every affected installation remains vulnerable until it is removed, isolated, or shielded. Leadership should treat this as a data-exposure risk to customer, employee, or business records stored in the same database, and prioritize containment over remediation timelines.
No vendor-released patch identified at time of analysis. Interim mitigations: deactivate or uninstall the Location Manager plugin where feasible; otherwise block external access to the geodir/v2/locations REST routes and requests using orderby=lat_lon via WAF, reverse proxy, or web server rules; apply virtual patching at the edge; ensure the WordPress database user has least privilege; and monitor web and database logs for anomalous queries against location tables.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
SQL injection exploits the way applications construct database queries by mixing user input directly into SQL statements.
Exploit-DB