CVE-2026-15300
CriticalCVSS 9.1Exploitation Probability (EPSS)
Low risk27th percentile - higher than 27% of all known CVEs
Summary
The GEO my WP plugin for WordPress up to version 4.5.4 is vulnerable to SQL injection via the 'distance', 'lat', and 'lng' parameters. Values are read from $_SERVER['QUERY_STRING'] via parse_str() (bypassing wp_magic_quotes) and passed through esc_sql() into numeric context in the proximity-search query, allowing injection.
Risk Assessment
An attacker can inject malicious SQL queries, potentially leading to unauthorized database access, data leakage, or site disruption.
Recommendation
Immediately update the GEO my WP plugin to version 4.5.5 or later, which includes fixes for the SQL injection vulnerability.
Other vulnerabilities in GEO my WP
See all- CVE-2026-85200High
The GEO my WP plugin for WordPress in all versions up to and including 4.5.5.3 is vulnerable to Local File Inclusion via the gmw_posts_locator_ajax_info_window_loader function. This enables unauthenticated attackers to include and execute arbitrary .php files on the server, allowing execution of any PHP code in those files, bypassing access controls, obtaining sensitive data, or achieving code execution. In environments where PEAR is installed with register_argc_argv enabled, this file inclusion can be leveraged to write and execute arbitrary PHP code, achieving full remote code execution.
- CVE-2026-15260Medium
The GEO my WP WordPress plugin before version 4.5.5.3 does not perform any ownership or capability check on two of its logged-in AJAX actions. This allows users with subscriber-level access or above to modify or permanently delete other users' and posts' geolocation records by supplying arbitrary record IDs.
- CVE-2026-9757High
The GEO my WP plugin for WordPress up to version 4.5.5 contains an SQL injection vulnerability via the 'swlatlng' and 'nelatlng' parameters, allowing unauthenticated attackers to append additional SQL queries and extract sensitive data. Exploitation requires a public page with the location search results shortcode.
Original NVD description (English source)
The GEO my WP plugin for WordPress was vulnerable to SQL Injection via the 'distance', 'lat', and 'lng' parameters in versions up to, and including, 4.5.4. The values were read from $_SERVER['QUERY_STRING'] via parse_str() (bypassing wp_magic_quotes, which does not cover $_SERVER), then passed through bare esc_sql() before being interpolated into unquoted numeric positions in the proximity-search query (HAVING/SELECT clause distance math, BETWEEN bounding-box pre-filter) built by gmw_locations_query() in plugins/posts-locator/includes/class-gmw-wp-query.php. Because esc_sql() only escapes string delimiters and these positions are numeric, payloads such as `1 OR SLEEP(3)` survived sanitization. Fixed in 4.5.5 by adding an upstream is_numeric() guard that short-circuits the WHERE clause to `AND 1 = 0` when either coordinate is non-numeric, and by replacing the three esc_sql() calls with (float) casts.