CVE-2026-9757
SQL Injection in GEO my WP WordPress Plugin
Publication date: 2026-05-30
Last updated on: 2026-05-30
Assigner: Wordfence
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| geomywp | geo_my_wp | to 4.5.5 (inc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-89 | The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data. |
Attack-Flow Graph
AI Powered Q&A
What immediate steps should I take to mitigate this vulnerability?
The immediate mitigation step is to update the GEO my WP plugin to a version later than 4.5.5 where this vulnerability is fixed.
If updating is not immediately possible, consider temporarily disabling the Posts Locator search-results shortcode ([gmw form="results" form_id=N]) on public pages to prevent exploitation.
Additionally, you can implement web application firewall (WAF) rules to block or sanitize requests containing suspicious 'swlatlng' and 'nelatlng' parameter values.
Can you explain this vulnerability to me?
The GEO my WP plugin for WordPress has a SQL Injection vulnerability in versions up to and including 4.5.5. This occurs via the 'swlatlng' and 'nelatlng' parameters, which are extracted from the query string in a way that bypasses WordPress's usual input protections. These parameters are split and directly inserted into a SQL BETWEEN clause without proper validation or sanitization, allowing attackers to inject malicious SQL code.
Exploitation requires the site to have the Posts Locator search-results shortcode on a public page and at least one published post with an associated location entry. An unauthenticated attacker can then append additional SQL queries to extract sensitive information from the database.
How can this vulnerability impact me? :
This vulnerability can allow unauthenticated attackers to extract sensitive information from your website's database by injecting malicious SQL queries. This can lead to data breaches, exposure of confidential information, and potential compromise of the website's integrity.
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability can be detected by monitoring HTTP requests to your WordPress site for suspicious usage of the 'swlatlng' and 'nelatlng' parameters in the query string. Since these parameters are vulnerable to SQL injection, look for unusual or malformed input values that include SQL syntax or additional queries.
You can use network monitoring tools or web server logs to identify requests containing these parameters. For example, using command-line tools like grep on your web server access logs to find requests with 'swlatlng' or 'nelatlng' parameters:
- grep -i 'swlatlng=' /var/log/apache2/access.log
- grep -i 'nelatlng=' /var/log/apache2/access.log
Additionally, you can use tools like curl or wget to test your site by sending crafted requests with these parameters to see if the site behaves unexpectedly or returns database errors.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
The vulnerability allows unauthenticated attackers to perform SQL Injection attacks that can extract sensitive information from the database.
Such unauthorized data exposure can lead to violations of data protection regulations like GDPR and HIPAA, which require safeguarding personal and sensitive information against unauthorized access.
Therefore, exploitation of this vulnerability could result in non-compliance with these common standards and regulations due to potential data breaches.