The GEO my WP plugin for WordPress is vulnerable to a CWE‑89 SQL Injection attack that allows unauthenticated users to append malicious SQL statements to queries. Attackers can exploit the swlatlng and nelatlng parameters read from the raw query string, bypassing WordPress’s sanitization, to retrieve sensitive data from the database or perform other destructive operations. The vulnerability is high severity with a CVSS score of 7.5, indicating a significant risk to confidentiality and integrity.

All installations of GEO my WP version 4.5.5 or earlier are affected. This includes any WordPress site that hosts the Posts Locator search‑results shortcode ([gmw form="results" form_id=N]) and has at least one published post containing a gmw_location entry. The issue spans the entire plugin code base that processes these latitude/longitude bounds, regardless of WordPress core or theme version.

The exploit requires only a crafted URL; no authentication is necessary. This inference is made based on the description, since the CVE does not explicitly state the attack vector. Because the vulnerability relies on parameters parsed from the query string, any visitor can trigger it. The lack of numeric validation lets an attacker inject additional SQL into the BETWEEN clause, leading to data disclosure or modification. With a CVSS of 7.5 and no EPSS data but high impact, the risk is considered high, and the vulnerability is not currently listed in CISA KEV. The attack vector is external via HTTP requests and the conditions are widely met on public sites that use the affected shortcode.