SQL Injection Vulnerability in GEO my WP Plugin for WordPress

CVE-2026-9757

What is CVE-2026-9757?

The GEO my WP plugin for WordPress contains a vulnerability that allows for SQL Injection through the 'swlatlng' and 'nelatlng' parameters. This occurs in all versions up to and including 4.5.5. The vulnerability arises from the way these parameters are handled; they are read directly from the server's query string and inserted into SQL statements without proper sanitation. This oversight allows unauthorized users to manipulate existing SQL queries, potentially allowing access to sensitive database information. Exploitation requires the presence of the Posts Locator feature on a public page, which increases the risk for sites with published posts that incorporate the location functionality.

References