Description
The GEO my WP plugin for WordPress was vulnerable to SQL Injection via the 'distance', 'lat', and 'lng' parameters in versions up to, and including, 4.5.4. The values were read from $_SERVER['QUERY_STRING'] via parse_str() (bypassing wp_magic_quotes, which does not cover $_SERVER), then passed through bare esc_sql() before being interpolated into unquoted numeric positions in the proximity-search query (HAVING/SELECT clause distance math, BETWEEN bounding-box pre-filter) built by gmw_locations_query() in plugins/posts-locator/includes/class-gmw-wp-query.php. Because esc_sql() only escapes string delimiters and these positions are numeric, payloads such as `1 OR SLEEP(3)` survived sanitization. Fixed in 4.5.5 by adding an upstream is_numeric() guard that short-circuits the WHERE clause to `AND 1 = 0` when either coordinate is non-numeric, and by replacing the three esc_sql() calls with (float) casts.
Published: 2026-07-10
Score: 9.1 Critical
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

The GEO my WP plugin for WordPress allows an attacker to inject arbitrary SQL through the 'distance', 'lat', and 'lng' query parameters. These values are extracted directly from the raw query string, bypassing WordPress’s magic quotes handling, and then sanitized only with esc_sql() before being placed in unquoted numeric positions of a proximity‑search query. Because the parameters are expected to be numeric, esc_sql() does not escape characters such as ‘OR’ or semicolons, enabling payloads like "1 OR SLEEP(3)" to survive sanitization. The result is a high‑severity vulnerability that can lead to unauthorized data access, data modification, and potential compromise of the entire database.

Affected Systems

WordPress sites running the GEO my WP plugin version 4.5.4 or earlier, which includes all releases from ninjew up to and including 4.5.4.

Risk and Exploitability

The vulnerability scores a CVSS of 9.1, indicating a very high impact. The EPSS score of <1% indicates a very low but non‑zero probability of exploitation. The issue is not listed in the CISA KEV catalog, but the vulnerability is publicly known, fully unauthenticated, and exploitable via crafted URLs. An attacker can execute arbitrary SQL statements on the database, potentially extracting or tampering with content, user data, and site configuration.

Generated by OpenCVE AI on July 29, 2026 at 11:22 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Update the GEO my WP plugin to version 4.5.5 or later; the patch adds numeric validation and float casts as a remedy for the CWE‑89 input‑validation flaw.
  • If upgrading immediately is not possible, disable or remove the Geo My WP plugin to eliminate the vulnerable query parameters.
  • As a temporary measure, configure a web application firewall or URL filtering rule to block or sanitize requests containing the 'distance', 'lat', or 'lng' parameters, mitigating the injection vector associated with CWE‑89.

Generated by OpenCVE AI on July 29, 2026 at 11:22 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Fri, 10 Jul 2026 16:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Fri, 10 Jul 2026 08:30:00 +0000

Type Values Removed Values Added
First Time appeared Ninjew
Ninjew geo My Wp
Wordpress
Wordpress wordpress
Vendors & Products Ninjew
Ninjew geo My Wp
Wordpress
Wordpress wordpress

Fri, 10 Jul 2026 05:15:00 +0000

Type Values Removed Values Added
Description The GEO my WP plugin for WordPress was vulnerable to SQL Injection via the 'distance', 'lat', and 'lng' parameters in versions up to, and including, 4.5.4. The values were read from $_SERVER['QUERY_STRING'] via parse_str() (bypassing wp_magic_quotes, which does not cover $_SERVER), then passed through bare esc_sql() before being interpolated into unquoted numeric positions in the proximity-search query (HAVING/SELECT clause distance math, BETWEEN bounding-box pre-filter) built by gmw_locations_query() in plugins/posts-locator/includes/class-gmw-wp-query.php. Because esc_sql() only escapes string delimiters and these positions are numeric, payloads such as `1 OR SLEEP(3)` survived sanitization. Fixed in 4.5.5 by adding an upstream is_numeric() guard that short-circuits the WHERE clause to `AND 1 = 0` when either coordinate is non-numeric, and by replacing the three esc_sql() calls with (float) casts.
Title GEO my WP <= 4.5.4 - Unauthenticated SQL Injection via 'distance' / 'lat' / 'lng' Parameters
Weaknesses CWE-89
References
Metrics cvssV3_1

{'score': 9.1, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H'}

Subscriptions

Ninjew Geo My Wp
Wordpress Wordpress
cve-icon MITRE

Status: PUBLISHED

Assigner: Wordfence

Published:

Updated: 2026-07-10T15:19:46.580Z

Reserved: 2026-07-09T15:54:32.605Z

Link: CVE-2026-15300

cve-icon Vulnrichment

Updated: 2026-07-10T15:19:42.457Z

cve-icon NVD

No data.

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-07-29T11:30:17Z

Weaknesses
  • CWE-89

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')