Executive brief
GEO my WP is a WordPress plugin used to add location-based search and mapping features to websites. A security flaw in the plugin allows unauthenticated attackers to interfere with the site's database by sending specially crafted web requests. This could lead to unauthorized data modification or service disruptions, potentially compromising the integrity of the website's location data and user information.
Technical details
A SQL injection vulnerability exists in GEO my WP versions up to 4.5.4 due to improper sanitization of the 'distance', 'lat', and 'lng' parameters. The plugin reads these values from $_SERVER['QUERY_STRING'] using parse_str(), which bypasses WordPress's default magic quotes protection. While the values are passed through esc_sql(), this function only escapes string delimiters; because the values are interpolated into unquoted numeric positions within the HAVING and SELECT clauses of the proximity-search query, numeric-based payloads (e.g., '1 OR SLEEP(3)') remain executable. An unauthenticated attacker can exploit this over the network to perform unauthorized database queries or modifications. The issue was fixed in version 4.5.5 by implementing is_numeric() validation and casting the inputs to floats.
Affected products
- ninjew GEO my WP up to, and including, 4.5.4
Timeline
- 2026-07-10: disclosed
- 2026-07-10: advisory
References
- https://plugins.trac.wordpress.org/browser/geo-my-wp/tags/4.5.4/plugins/posts-locator/includes/class-gmw-wp-query.php
- https://plugins.trac.wordpress.org/browser/geo-my-wp/tags/4.5.4/plugins/posts-locator/includes/class-gmw-wp-query.php
- https://plugins.trac.wordpress.org/browser/geo-my-wp/tags/4.5.4/plugins/posts-locator/includes/class-gmw-wp-query.php
- https://plugins.trac.wordpress.org/browser/geo-my-wp/tags/4.5.5/plugins/posts-locator/includes/class-gmw-wp-query.php
- https://plugins.trac.wordpress.org/browser/geo-my-wp/tags/4.5.5/plugins/posts-locator/includes/class-gmw-wp-query.php
- https://www.wordfence.com/threat-intel/vulnerabilities/id/ecbc7f05-fc4f-4276-968e-04222a64e55a?source=cve