CVE-2026-9757
HighCVSS 7.5Exploitation Probability (EPSS)
Low risk27th percentile - higher than 27% of all known CVEs
Summary
The GEO my WP plugin for WordPress up to version 4.5.5 contains an SQL injection vulnerability via the 'swlatlng' and 'nelatlng' parameters, allowing unauthenticated attackers to append additional SQL queries and extract sensitive data. Exploitation requires a public page with the location search results shortcode.
Risk Assessment
An attacker could steal sensitive data from the WordPress database, leading to site compromise and potential user data theft.
Recommendation
Update the GEO my WP plugin to the latest version and use parameterized SQL queries.
Other vulnerabilities in GEO my WP
See all- CVE-2026-15300Critical
The GEO my WP plugin for WordPress up to version 4.5.4 is vulnerable to SQL injection via the 'distance', 'lat', and 'lng' parameters. Values are read from $_SERVER['QUERY_STRING'] via parse_str() (bypassing wp_magic_quotes) and passed through esc_sql() into numeric context in the proximity-search query, allowing injection.
- CVE-2026-15260Medium
The GEO my WP WordPress plugin before version 4.5.5.3 does not perform any ownership or capability check on two of its logged-in AJAX actions. This allows users with subscriber-level access or above to modify or permanently delete other users' and posts' geolocation records by supplying arbitrary record IDs.
Original NVD description (English source)
The GEO my WP plugin for WordPress is vulnerable to SQL Injection via the 'swlatlng' and 'nelatlng' parameters in all versions up to, and including, 4.5.5 The parameters are read from $_SERVER['QUERY_STRING'] via parse_str() (bypassing WordPress's wp_magic_quotes protection, which only covers $_POST/$_GET/$_COOKIE/$_REQUEST), then each is split on ',' via explode() and the resulting fragments are interpolated directly into a SQL BETWEEN clause in gmw_get_locations_within_boundaries_sql() without is_numeric() validation, (float) casting, esc_sql(), or $wpdb->prepare(). This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. Exploitation requires the site to host the Posts Locator search-results shortcode (`[gmw form="results" form_id=N]`) on a public page and to have at least one published post with an associated gmw_location row.