Unauthenticated SQL injection occurs in the WordPress GeoDirectory plugin versions up to 2.8.162. The flaw permits an attacker to inject arbitrary SQL statements into database queries, potentially exposing sensitive data, modifying site content, or, if the database allows it, could lead to broader compromise. The vulnerability is mapped to CWE‑89, highlighting the violation of proper input sanitization and parameterized query usage. Based on the description, it is inferred that the plugin may perform database operations without proper escaping, but the CVE does not explicitly state remote code execution or other specific consequences.

The affected product is the GeoDirectory WordPress plugin, developed by Paolo. Any WordPress site that has installed the plugin at or below version 2.8.162 is susceptible. If the site uses an earlier or equivalent version, the same issue applies.

The CVSS score of 9.3 indicates high severity. The lack of an EPSS value does not prove low exploitation probability; attackers could still target this flaw. The vulnerability is not listed in the CISA KEV catalog. The unauthenticated nature and the possibility to inject SQL through a plugin endpoint make it a high‑risk threat. An attacker could craft a malicious HTTP request to the plugin’s data submission endpoint, injecting SQL via a vulnerable parameter.