EUVD-2026-39675
GHSA-rprv-mwvc-g7cw
Severity by source
AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L
Unauthenticated network SQLi (AV:N/AC:L/PR:N/UI:N) yields high DB confidentiality (C:H) and possible limited writes (I:L); I keep S:U absent evidence the injection crosses a security authority, unlike the vendor's S:C.
Primary rating from Vendor (patchstack).
CVSS VectorVendor: patchstack
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L
Lifecycle Timeline
1DescriptionCVE.org
Unauthenticated SQL Injection in GeoDirectory <= 2.8.162 versions.
AnalysisAI
SQL injection in the GeoDirectory WordPress plugin (versions up to and including 2.8.162) allows remote unauthenticated attackers to inject malicious SQL into backend queries, per Patchstack. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) with PR:N indicates exploitation requires no authentication, and the scope-changed, high-confidentiality rating (S:C/C:H) points to database disclosure beyond the plugin's own data. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires only network access to a WordPress site running GeoDirectory version 2.8.162 or earlier with the vulnerable (likely public listing/search) functionality reachable - the CVSS vector AV:N/AC:L/PR:N/UI:N confirms no authentication and no user interaction are needed, matching default exposure of a public directory site. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | Signals are partially aligned but incomplete. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An unauthenticated attacker sends a crafted HTTP request to a public GeoDirectory listing or search endpoint, embedding SQL metacharacters in a parameter that reaches an unprepared database query. The injected query returns sensitive rows (e.g., wp_users hashes, wp_options secrets), enabling credential harvesting or further site compromise. … |
| Remediation | No vendor-released patch version was identified in the supplied data; the advisory only defines the affected range as <= 2.8.162, so the immediate action is to upgrade GeoDirectory to the next release published after 2.8.162 that the vendor designates as fixed - confirm the exact patched version via the Patchstack advisory (https://patchstack.com/database/wordpress/plugin/geodirectory/vulnerability/wordpress-geodirectory-plugin-2-8-162-sql-injection-vulnerability?_s_id=cve) and the official WordPress.org plugin changelog before deploying. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours: Identify all WordPress instances with GeoDirectory plugin active; immediately disable or uninstall any version ≤2.8.162; if removal is not feasible, isolate the affected server network segment and restrict database access. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-89 – SQL Injection
View allShare
External POC / Exploit Code
Leaving vuln.today