An unauthenticated SQL injection flaw exists in the WordPress GeoDirectory plugin up to version 2.8.152. The vulnerability allows an attacker to inject arbitrary SQL statements through unsanitized input, potentially enabling the retrieval, modification, or deletion of database contents. This can compromise the confidentiality, integrity, and potentially the availability of the application. The weakness is catalogued as CWE-89, indicating an input validation defect that permits malicious SQL code to be executed.

WordPress sites running the GeoDirectory plugin version 2.8.152 or earlier are impacted. The most recent fixed release is 2.8.154 and later versions are considered safe.

The CVSS score of 9.3 marks the issue as critical. Although the EPSS score is less than 1%, suggesting a low exploitation probability at this moment, the vulnerability is not listed in CISA’s KEV catalog, implying no known widespread exploitation yet. The likely attack vector is unauthenticated, meaning any internet‑connected user could exploit the flaw without prior credentials. If exploited, an attacker could gain full control over the database, enabling further attacks such as privilege escalation or data exfiltration.