WordPress Location Manager SQL Injection via REST API Parameters

The Location Manager plugin for WordPress is vulnerable to generic SQL Injection via 'latitude' and 'longitude' REST API Parameters in all versions up to, and including, 2.3.38 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. The injection is triggered when the orderby=lat_lon parameter is supplied, and affects multiple publicly accessible REST endpoints including geodir/v2/locations/cities, /regions, /countries, and /neighbourhoods via both the get_locations() and get_neighbourhoods() functions.

Casky was already ahead

This CVE exploits attack patterns that Casky's 323matched skills already investigate — long before this vulnerability was disclosed. Claude's reasoning model maps these techniques to MITRE ATT&CK, so practitioners who ran these skills have already seen the threat behaviour in their findings.

Analysis

The Location Manager plugin for WordPress contains a SQL injection vulnerability in its REST API endpoints, specifically within the 'latitude' and 'longitude' parameters. This CWE-89 flaw affects all versions up to 2.3.38 and allows unauthenticated attackers to inject arbitrary SQL commands into database queries due to insufficient input escaping and lack of prepared statement usage. Any WordPress installation running this plugin is exposed to data exfiltration attacks, making sensitive information in the database—including user credentials, personal data, and administrative details—accessible to threat actors without authentication requirements.

Casky's 323 mapped security skills leverage Claude's extended reasoning to identify attack patterns associated with TA0001 (Reconnaissance) and TA0043 (Reconnaissance via public internet sources). Practitioners using Casky will observe detection capabilities focused on anomalous REST API parameter values containing SQL syntax patterns, suspicious database query structures, and unauthorized data extraction attempts. The platform would flag reconnaissance activity where attackers probe the REST API endpoints with SQL payloads, identify when additional SQL clauses are appended to legitimate queries, and alert on unusual data retrieval patterns indicative of database exfiltration. By analyzing the injection vectors and attack prerequisites, Casky helps practitioners correlate these techniques with known exploitation patterns, enabling faster incident response and remediation before sensitive data is compromised.

Live Threat IntelligenceComing soon

Casky Risk Score

—

EPSS Probability

—

Shodan Exposure

—

GreyNoise Signal

—

Composite risk scoring from EPSS, CISA KEV, Shodan, and GreyNoise — 21 security APIs correlated into a single Casky Risk Score. Coming in Casky Pro. Join early access →

323 Casky skills cover this attack pattern

These skills use Claude AI's reasoning model to surface findings in the same attack categories as CVE-2026-85705.

Abuse of Public-Facing API: Mobile API Abuse

mobile security · low

Run

abusing-dpapi-for-credential-access

red teaming · high

Run

abusing-shadow-credentials-for-privesc

red teaming · high

Run

MITRE ATT&CK Techniques

TA0001 TA0043

Investigate the attack patterns behind CVE-2026-85705

Casky has 323 skills that investigate the attack patterns behind CVE-2026-85705. Run one and get CVSS-scored findings in 3 minutes.

Run the skill that detects this →

X Instagram LinkedIn