SQL Injection in Location Manager Plugin for WordPress

The Location Manager plugin for WordPress is vulnerable to generic SQL injection in all versions up to and including 2.3.38. The vulnerability exists due to insufficient escaping of user-supplied input and a lack of prepared statements in the plugin's SQL query construction. Attackers can exploit this flaw by sending specifically crafted HTTP requests to the REST API.

When the 'orderby=lat_lon' parameter is combined with manipulated 'latitude' or 'longitude' parameters, the underlying database queries in the get_locations() and get_neighbourhoods() functions are improperly sanitized. This allows unauthenticated remote attackers to append malicious SQL commands to legitimate queries. Exploitation can result in unauthorized access to and exfiltration of sensitive information contained within the WordPress database. Affected endpoints include /geodir/v2/locations/cities, /regions, /countries, and /neighbourhoods.

Impact

Successful exploitation allows unauthenticated attackers to perform blind or error-based SQL injection, potentially leading to full database compromise or the extraction of sensitive site data, user credentials, or configuration details.

Recommendation

• Upgrade the Location Manager plugin to the latest version (v2.3.39 or higher) immediately to resolve the lack of input sanitization.
• Implement a Web Application Firewall (WAF) rule to inspect and block incoming HTTP requests to REST API endpoints containing 'orderby=lat_lon' that also include SQL keywords or syntax (e.g., SELECT, UNION, SLEEP) in the latitude/longitude parameters.
• Review database access logs for unusual query patterns or unexpected error messages originating from the plugin's REST API endpoints.