SQL Injection in WordPress GeoDirectory Plugin Coordinates

The GeoDirectory plugin for WordPress is vulnerable to SQL Injection via the stored latitude/longitude coordinates of a listing in versions up to, and including, 2.8.186. This is due to insufficient escaping and the absence of numeric validation on coordinate values when a listing is saved, combined with the direct string interpolation of those values into a distance sub-expression in geodir_gps_query_part() that is later executed by the public wp_ajax_nopriv_geodir_widget_listings handler when a caller supplies set_post=<pending-listing-id> and sort_by=distance_asc. This makes it possible for authenticated attackers, with Subscriber-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.

Casky was already ahead

This CVE exploits attack patterns that Casky's 323matched skills already investigate — long before this vulnerability was disclosed. Claude's reasoning model maps these techniques to MITRE ATT&CK, so practitioners who ran these skills have already seen the threat behaviour in their findings.

Analysis

The GeoDirectory plugin for WordPress contains a critical SQL injection vulnerability affecting versions up to 2.8.186. The flaw stems from insufficient input validation and escaping of latitude/longitude coordinate values when listings are saved. These unsanitized coordinates are directly interpolated into SQL distance calculation queries executed by the wp_ajax_nopriv_geodir_widget_listings AJAX handler, allowing unauthenticated attackers to inject arbitrary SQL commands. This vulnerability is particularly concerning because GeoDirectory is widely deployed across WordPress sites for location-based directory functionality, potentially exposing thousands of installations to database compromise, data exfiltration, and unauthorized access.

Casky.ai's platform identifies attack patterns associated with this vulnerability by mapping 323 relevant security skills against MITRE ATT&CK techniques TA0001 (Reconnaissance) and TA0043 (Reconnaissance - Gather Victim Org Information). When practitioners enable detection for SQL injection patterns, Claude AI with extended reasoning analyzes suspicious AJAX requests to the geodir_widget_listings endpoint, flagging attempts to manipulate coordinate parameters with SQL syntax. Practitioners would observe findings highlighting: malformed numeric input in latitude/longitude fields, unexpected SQL keywords (UNION, SELECT, OR) embedded in coordinate values, unusual distance calculation queries in application logs, and abnormal database query patterns. The platform correlates these indicators with known exploitation chains, enabling teams to distinguish legitimate geolocation queries from injection attempts and prioritize remediation efforts for vulnerable plugin instances.

Live Threat IntelligenceComing soon

Casky Risk Score

—

EPSS Probability

—

Shodan Exposure

—

GreyNoise Signal

—

Composite risk scoring from EPSS, CISA KEV, Shodan, and GreyNoise — 21 security APIs correlated into a single Casky Risk Score. Coming in Casky Pro. Join early access →

323 Casky skills cover this attack pattern

These skills use Claude AI's reasoning model to surface findings in the same attack categories as CVE-2026-103913.

Abuse of Public-Facing API: Mobile API Abuse

mobile security · low

Run

abusing-dpapi-for-credential-access

red teaming · high

Run

abusing-shadow-credentials-for-privesc

red teaming · high

Run

MITRE ATT&CK Techniques

TA0001 TA0043

Investigate the attack patterns behind CVE-2026-103913

Casky has 323 skills that investigate the attack patterns behind CVE-2026-103913. Run one and get CVSS-scored findings in 3 minutes.

Run the skill that detects this →

X Instagram LinkedIn