CVE-2026-103913

Summary

The GeoDirectory WordPress plugin contains a SQL injection vulnerability in versions up to 2.8.186 where stored latitude/longitude coordinates are not properly escaped, allowing attackers to inject malicious SQL into distance calculation queries. This enables authenticated users with subscriber-level access or higher to extract sensitive database information.

Exploitability

Exploitation requires an authenticated user with subscriber privileges who can create or modify listings with geolocation data, and then trigger the vulnerable wp_ajax_nopriv_geodir_widget_listings endpoint with specific parameters to execute the injected SQL.

Blast radius

The vulnerability affects all WordPress sites using GeoDirectory plugin version 2.8.186 or earlier, potentially exposing sensitive user data, configuration settings, and other database contents to authenticated attackers who can manipulate listing coordinates.

Detection

No reliable host or network indicator is derivable from the published description.

Prioritized remediation

Upgrade to version 2.8.187 or later to remediate this SQL injection vulnerability.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.