CVE-2026-9757
Deferred Deferred - Pending Action
SQL Injection in GEO my WP WordPress Plugin

Publication date: 2026-05-30

Last updated on: 2026-06-01

Assigner: Wordfence

Description
The GEO my WP plugin for WordPress is vulnerable to SQL Injection via the 'swlatlng' and 'nelatlng' parameters in all versions up to, and including, 4.5.5 The parameters are read from $_SERVER['QUERY_STRING'] via parse_str() (bypassing WordPress's wp_magic_quotes protection, which only covers $_POST/$_GET/$_COOKIE/$_REQUEST), then each is split on ',' via explode() and the resulting fragments are interpolated directly into a SQL BETWEEN clause in gmw_get_locations_within_boundaries_sql() without is_numeric() validation, (float) casting, esc_sql(), or $wpdb->prepare(). This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. Exploitation requires the site to host the Posts Locator search-results shortcode (`[gmw form="results" form_id=N]`) on a public page and to have at least one published post with an associated gmw_location row.
CVSS Scores
EPSS Scores
Probability:
Percentile:
Meta Information
Published
2026-05-30
Last Modified
2026-06-01
Generated
2026-06-19
AI Q&A
2026-05-30
EPSS Evaluated
2026-06-18
NVD
CVE-2026-9757
EUVD
EUVD-2026-33453
Affected Vendors & Products
Showing 1 associated CPE
Vendor Product Version / Range
geomywp geo_my_wp to 4.5.5 (inc)
Helpful Resources
Exploitability
CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-89 The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.
Attack-Flow Graph
AI Quick Actions
Instant insights powered by AI
Mitigation Strategies

The immediate mitigation step is to update the GEO my WP plugin to a version later than 4.5.5 where this vulnerability is fixed.

If updating is not immediately possible, consider temporarily disabling the Posts Locator search-results shortcode ([gmw form="results" form_id=N]) on public pages to prevent exploitation.

Additionally, you can implement web application firewall (WAF) rules to block or sanitize requests containing suspicious 'swlatlng' and 'nelatlng' parameter values.

Executive Summary

The GEO my WP plugin for WordPress has a SQL Injection vulnerability in versions up to and including 4.5.5. This occurs via the 'swlatlng' and 'nelatlng' parameters, which are extracted from the query string in a way that bypasses WordPress's usual input protections. These parameters are split and directly inserted into a SQL BETWEEN clause without proper validation or sanitization, allowing attackers to inject malicious SQL code.

Exploitation requires the site to have the Posts Locator search-results shortcode on a public page and at least one published post with an associated location entry. An unauthenticated attacker can then append additional SQL queries to extract sensitive information from the database.

Impact Analysis

This vulnerability can allow unauthenticated attackers to extract sensitive information from your website's database by injecting malicious SQL queries. This can lead to data breaches, exposure of confidential information, and potential compromise of the website's integrity.

Detection Guidance

This vulnerability can be detected by monitoring HTTP requests to your WordPress site for suspicious usage of the 'swlatlng' and 'nelatlng' parameters in the query string. Since these parameters are vulnerable to SQL injection, look for unusual or malformed input values that include SQL syntax or additional queries.

You can use network monitoring tools or web server logs to identify requests containing these parameters. For example, using command-line tools like grep on your web server access logs to find requests with 'swlatlng' or 'nelatlng' parameters:

  • grep -i 'swlatlng=' /var/log/apache2/access.log
  • grep -i 'nelatlng=' /var/log/apache2/access.log

Additionally, you can use tools like curl or wget to test your site by sending crafted requests with these parameters to see if the site behaves unexpectedly or returns database errors.

Compliance Impact

The vulnerability allows unauthenticated attackers to perform SQL Injection attacks that can extract sensitive information from the database.

Such unauthorized data exposure can lead to violations of data protection regulations like GDPR and HIPAA, which require safeguarding personal and sensitive information against unauthorized access.

Therefore, exploitation of this vulnerability could result in non-compliance with these common standards and regulations due to potential data breaches.

Chat Assistant
Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-9757. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70
EPSS Chart