What is the CVSS score of CVE-2026-9757?

CVE-2026-9757 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.1%.

Which versions of GEO my WP are affected by CVE-2026-9757?

GEO my WP WordPress plugin versions 4.5.5 and earlier contain an unauthenticated SQL injection vulnerability that permits attackers to extract sensitive database contents through public-facing plugin…

How to fix or mitigate CVE-2026-9757?

Within 24 hours: Disable GEO my WP plugin or restrict access to pages containing the Posts Locator shortcode via IP allowlist or authentication requirement. Within 7 days: Monitor vendor advisory for patch availability; if unavailable, implement Web Application Firewall rules blocking SQL injection patterns in the 'swlatlng' and 'nelatlng' query parameters. Within 30 days: Review database access logs for unauthorized queries and audit user tables for signs of exploitation.

GEO my WP CVE-2026-9757

EUVD-2026-33453 HIGH

SQL Injection (CWE-89)

2026-05-30 Wordfence

GHSA-823p-x8f9-wj7r

WordPress SQLi Wordpress Plugin Geo My Wp

7.5

CVSS 3.1 · Vendor: Wordfence

Severity by source

Vendor (Wordfence) PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Primary rating from Vendor (Wordfence) · only source for this CVE.

CVSS VectorVendor: Wordfence

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

May 30, 2026 - 09:57 vuln.today

CVE Published

May 30, 2026 - 09:28 nvd

HIGH 7.5

DescriptionCVE.org

The GEO my WP plugin for WordPress is vulnerable to SQL Injection via the 'swlatlng' and 'nelatlng' parameters in all versions up to, and including, 4.5.5 The parameters are read from $_SERVER['QUERY_STRING'] via parse_str() (bypassing WordPress's wp_magic_quotes protection, which only covers $_POST/$_GET/$_COOKIE/$_REQUEST), then each is split on ',' via explode() and the resulting fragments are interpolated directly into a SQL BETWEEN clause in gmw_get_locations_within_boundaries_sql() without is_numeric() validation, (float) casting, esc_sql(), or $wpdb->prepare(). This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. Exploitation requires the site to host the Posts Locator search-results shortcode ([gmw form="results" form_id=N]) on a public page and to have at least one published post with an associated gmw_location row.

AnalysisAI

SQL injection in the GEO my WP WordPress plugin (versions ≤4.5.5) allows unauthenticated remote attackers to append arbitrary SQL via the 'swlatlng' and 'nelatlng' query-string parameters, enabling extraction of sensitive database contents. The flaw stems from reading parameters directly from $_SERVER['QUERY_STRING'] with parse_str(), bypassing WordPress's wp_magic_quotes sanitization. No public exploit identified at time of analysis, and the vulnerability is not currently listed in CISA KEV, but exploitation requires only a public page hosting the Posts Locator results shortcode.

Technical ContextAI

GEO my WP is a geolocation/proximity-search plugin for WordPress published by 'ninjew' (CPE cpe:2.3:a:ninjew:geo_my_wp). The root cause is CWE-89 (Improper Neutralization of Special Elements used in an SQL Command). Specifically, gmw_get_locations_within_boundaries_sql() builds a SQL BETWEEN clause from latitude/longitude bounding-box parameters obtained by parsing the raw $_SERVER['QUERY_STRING'] via PHP's parse_str(). Because WordPress's wp_magic_quotes only sanitizes the $_POST, $_GET, $_COOKIE, and $_REQUEST superglobals, values pulled from $_SERVER bypass that protection. The 'swlatlng' and 'nelatlng' strings are split on commas with explode() and interpolated directly into the SQL string with no is_numeric() check, no (float) cast, no esc_sql(), and no $wpdb->prepare() parameterization, so an attacker can break out of the numeric context.

RemediationAI

Upgrade GEO my WP to version 4.5.5.1 or later, which contains the upstream fix shipped in WordPress.org plugin changeset 3552886 (https://plugins.trac.wordpress.org/changeset/3552886/geo-my-wp/trunk/includes/gmw-functions.php); this is the vendor-released patch. Until the update can be applied, operators can remove or unpublish any page containing the Posts Locator results shortcode [gmw form="results" form_id=N] to eliminate the entry point, accepting the trade-off of losing geo search-results functionality for site visitors. As an additional compensating control, a WAF rule blocking requests whose query string contains 'swlatlng' or 'nelatlng' values that are not strictly two comma-separated floats can be deployed, but this may interfere with legitimate map searches and should be tested. Refer to the Wordfence advisory at https://www.wordfence.com/threat-intel/vulnerabilities/id/042f78a4-2256-4286-aa03-8bd8b7a79530?source=cve for full details.