Description

Unauthenticated SQL Injection in GeoDirectory <= 2.8.174 versions.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.3",
  "pubDate": "2026-09-03T17:17:29.157Z",
  "pubdate": "2026-09-03T17:17:29.157Z",
  "executiveSummary": "The GeoDirectory plugin for WordPress, in versions <= 2.8.174, is susceptible to an unauthenticated SQL Injection (SQLi) vulnerability.\nThis flaw arises from improper neutralization of user-supplied input before incorporating it into database queries, allowing remote, unauthenticated attackers to execute arbitrary SQL commands.\nSuccessful exploitation grants attackers the capability to bypass security controls, perform unauthorized data exfiltration, modify database contents, or potentially achieve full administrative compromise of the WordPress installation.\nThe vulnerability represents a critical security risk as it requires no prior authentication or administrative privileges to execute, making it accessible to any network-adjacent attacker.\nThe impact includes total confidentiality loss, data integrity compromise, and potential availability disruption of the affected web application.",
  "technicalDetails": "The vulnerability originates from a failure to sanitize or parameterize input parameters processed by the GeoDirectory plugin before they are concatenated into SQL queries.\nIn the affected versions (<= 2.8.174), specific endpoints or internal functions within the plugin fail to validate user-controllable input properly, introducing an injection vector.\nThe attack flow begins with an attacker identifying a vulnerable entry point within the plugin's request handling logic. The attacker sends a crafted HTTP request containing malicious SQL syntax within the unsanitized input fields.\nBecause the plugin does not utilize prepared statements or appropriate escaping mechanisms for the affected input parameters, the database engine executes the injected SQL commands as part of the intended query structure.\nThis allows the attacker to manipulate the underlying query logic—for example, by using UNION-based SQLi to append malicious SELECT statements, or boolean-based/time-based blind techniques to infer data from the database schema.\nThe exploitation allows an attacker to interact with the database directly, bypassing standard WordPress authentication and authorization checks. This capability can be leveraged to extract sensitive information stored in the wp_users table, such as hashed passwords, email addresses, and metadata.\nFurthermore, depending on the database configuration and permissions, an attacker might be able to escalate privileges by modifying user roles or injecting administrative accounts.\nThe lack of authentication requirements means the attack surface is exposed to any user capable of reaching the plugin's frontend or backend API endpoints. Post-exploitation impact is severe, often resulting in complete control over the WordPress application's data layer."
}