Is CVE-2026-85705 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-85705 being exploited in the wild.

How severe is CVE-2026-85705?

High severity, with a CVSS score of 7.5, published 18 September 2026.

Which products and versions are affected?

GeoDirectory Location Manager up to 2.3.38.

Is there a fix for CVE-2026-85705?

A patch was published on 2026-09-18: Version 2.3.39 released with fixes Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-85705 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-85705?

Check whether you run GeoDirectory Location Manager at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-85705: GeoDirectory Location Manager SQL injection via REST API

CVE-2026-85705 · Severity: high · CVSS 7.5 · Published 2026-09-18

The Location Manager plugin for WordPress enables global multi-location directory functionality for websites. An unauthenticated attacker can exploit a SQL injection vulnerability in the plugin's REST API endpoints to extract sensitive data from the database, including user information and business listings, potentially compromising the entire directory website's data integrity and privacy.

Vendors: GeoDirectory.

Quick answers

Is CVE-2026-85705 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-85705 being exploited in the wild.
How severe is CVE-2026-85705?: High severity, with a CVSS score of 7.5, published 18 September 2026.
Which products and versions are affected?: GeoDirectory Location Manager up to 2.3.38.
Is there a fix for CVE-2026-85705?: A patch was published on 2026-09-18: Version 2.3.39 released with fixes Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-85705 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-85705?: Check whether you run GeoDirectory Location Manager at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The Location Manager plugin contains a SQL injection vulnerability in its REST API location endpoints (geodir/v2/locations/cities, /regions, /countries, and /neighbourhoods). The vulnerability exists in the get_locations() and get_neighbourhoods() functions where user-supplied latitude and longitude parameters are insufficiently escaped and not properly prepared in SQL queries. When an attacker supplies the orderby=lat_lon parameter, they can inject arbitrary SQL code into the query. The vulnerability is network-accessible and requires no authentication or user interaction, allowing unauthenticated attackers to execute arbitrary SELECT queries to extract sensitive database information. The plugin versions up to 2.3.38 are affected; version 2.3.39 and later contain fixes.

Affected products

GeoDirectory Location Manager up to 2.3.38

Timeline

2026-09-18: disclosed
2026-09-18: patched: Version 2.3.39 released with fixes

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.