Executive brief
The Location Manager plugin for WordPress enables global multi-location directory functionality for websites. An unauthenticated attacker can exploit a SQL injection vulnerability in the plugin's REST API endpoints to extract sensitive data from the database, including user information and business listings, potentially compromising the entire directory website's data integrity and privacy.
Technical details
The Location Manager plugin contains a SQL injection vulnerability in its REST API location endpoints (geodir/v2/locations/cities, /regions, /countries, and /neighbourhoods). The vulnerability exists in the get_locations() and get_neighbourhoods() functions where user-supplied latitude and longitude parameters are insufficiently escaped and not properly prepared in SQL queries. When an attacker supplies the orderby=lat_lon parameter, they can inject arbitrary SQL code into the query. The vulnerability is network-accessible and requires no authentication or user interaction, allowing unauthenticated attackers to execute arbitrary SELECT queries to extract sensitive database information. The plugin versions up to 2.3.38 are affected; version 2.3.39 and later contain fixes.
Affected products
- GeoDirectory Location Manager up to 2.3.38
Timeline
- 2026-09-18: disclosed
- 2026-09-18: patched: Version 2.3.39 released with fixes