SQL Injection in GeoDirectory WordPress Plugin

The GeoDirectory plugin for WordPress, in versions up to and including 2.8.186, contains a SQL injection vulnerability. The flaw originates from the geodir_gps_query_part() function, which fails to properly escape or validate latitude and longitude coordinate values before interpolating them into a database query string. This vulnerability is triggered when the application handles requests through the wp_ajax_nopriv_geodir_widget_listings handler. An attacker with Subscriber-level access can supply a malicious, crafted latitude or longitude coordinate during a listing update process. When the application subsequently processes a request with the sort_by=distance_asc parameter, the unvalidated coordinate input is executed as part of a SQL query. This allows attackers to manipulate database queries, potentially leading to unauthorized data exfiltration or sensitive information disclosure from the underlying WordPress database.

Impact

Successful exploitation of this vulnerability allows authenticated attackers with minimal privileges (Subscriber) to read sensitive data from the site database. This could include user credentials, personally identifiable information (PII), or other sensitive configuration data stored in the WordPress environment. The impact is significant for organizations relying on GeoDirectory for their business listings or directory services.

Recommendation

Update the GeoDirectory plugin to a patched version beyond 2.8.186 immediately. Ensure that all WordPress plugins are kept up to date and that administrative/subscriber privileges are strictly managed. Conduct a audit of database logs for unusual query patterns originating from the wp_ajax_nopriv_geodir_widget_listings handler.