Is CVE-2026-9757 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-9757 being exploited in the wild.

How severe is CVE-2026-9757?

High severity, with a CVSS score of 7.5, published 30 May 2026.

Which products and versions are affected?

GEO my WP Up to and including 4.5.5.

Is there a fix for CVE-2026-9757?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-9757 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-9757?

Check whether you run GEO my WP at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-9757: GEO my WP SQL injection in gmw_get_locations_within_boundaries_sql

CVE-2026-9757 · Severity: high · CVSS 7.5 · Published 2026-05-30

GEO my WP is a WordPress plugin used to add location-based search and mapping features to websites. A security flaw allows unauthenticated visitors to perform unauthorized database queries by manipulating specific web address parameters. This could lead to the theft of sensitive information, such as user data or site configuration details, from the website's database.

Technologies: GEO my WP. Vendors: GEO my WP.

Quick answers

Is CVE-2026-9757 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-9757 being exploited in the wild.
How severe is CVE-2026-9757?: High severity, with a CVSS score of 7.5, published 30 May 2026.
Which products and versions are affected?: GEO my WP Up to and including 4.5.5.
Is there a fix for CVE-2026-9757?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-9757 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-9757?: Check whether you run GEO my WP at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The GEO my WP plugin for WordPress is vulnerable to SQL injection due to improper handling of the 'swlatlng' and 'nelatlng' parameters in the gmw_get_locations_within_boundaries_sql() function. These parameters are parsed directly from the query string using parse_str(), which bypasses WordPress's built-in magic quotes protection. The values are then exploded and interpolated into a SQL BETWEEN clause without being cast to floats, validated as numeric, or passed through $wpdb->prepare(). An unauthenticated attacker can exploit this by sending crafted requests to a page containing the Posts Locator search-results shortcode, provided at least one post has associated location data. This allows for the extraction of sensitive data via boolean-based or time-based blind SQL injection.

Affected products

GEO my WP GEO my WP Up to and including 4.5.5

Timeline

2026-05-30: advisory: CVE-2026-9757 published

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.