GeoDirectory EUVD-2026-91921

Requires an authenticated Subscriber-level (or higher) account, so sites that disable open user registration are substantially protected. The attacker must be able to create a listing and store a crafted payload in the listing's latitude/longitude coordinate fields (which lack numeric validation and escaping), then invoke the wp_ajax_nopriv_geodir_widget_listings handler with set_post=<their-pending-listing-id> and sort_by=distance_asc to reach the vulnerable distance sub-expression in geodir_gps_query_part(). Affected versions are GeoDirectory ≤ 2.8.186; no user interaction from a victim is needed. Limiting factors: authentication requirement (Subscriber+), attacker must own a listing in pending state, and the specific sort_by=distance_asc/set_post request parameters must be supplied.

This is a genuine but conditional concern rather than a top-tier emergency. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N, score 7.5, confidentiality-only) models a network-reachable, low-complexity, no-interaction SQL injection with high data-exposure impact - which on its face looks like a drive-by credential/data theft bug. However, there is a direct and important conflict between the CVSS vector and the Wordfence-authored description: the vector asserts PR:N (unauthenticated), while the description explicitly states exploitation requires 'authenticated attackers, with Subscriber-level access and above.' The exploit path also requires a pending listing the attacker controls (set_post=<pending-listing-id>) plus sort_by=distance_asc against the wp_ajax_nopriv_geodir_widget_listings handler. The Subscriber-level requirement is a meaningful mitigant where open/self-registration is disabled, but it is a low bar on sites that allow public account creation (common for directory sites that use this plugin). No EPSS score, no CISA KEV listing, and no public POC are present in the provided data, so there is no evidence of active exploitation or weaponization - this reads as a high-severity-by-impact but not-yet-exploited issue. Net priority: patch promptly on internet-facing sites that permit user registration; lower urgency where registration is closed. Treat the PR:N in the vector as likely mislabeled - verify against Wordfence, because it materially changes the real exploitation bar.

On a GeoDirectory site that permits user registration, an attacker registers a Subscriber account, creates a (pending) listing, and stores a crafted SQL payload in the latitude/longitude coordinate fields, which are interpolated unsanitized into the distance sub-expression of geodir_gps_query_part(). The attacker then calls the geodir_widget_listings AJAX endpoint with set_post set to their pending listing's ID and sort_by=distance_asc, causing the injected SQL to execute and return sensitive database contents (e.g., user data, password hashes). No public exploit code is identified at time of analysis, but the described path is deterministic and the vendor has detailed the exact trigger.