GeoDirectory – WP Business Directory Plugin and Classified Listings Directory <= 2.8.198 - Unauthenticated SQL Injection via 'post_type' Parameter
- ID
- WPSEC-2026-2112
- Plugin
- GeoDirectory – WP Business Directory Plugin and Classified Listings Directory (geodirectory)
- Affected
- all versions before 2.8.199
- Remediation
- Update to 2.8.199 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
- Weakness
- CWE-89
- Usage
- Plugin Low · Affected versions Low among sites WPSec scans, 2026-10-30
- Attack surface
- GeoDirectory – WP Business Directory Plugin and Classified Listings Directory on WPSec AttackSurface
- Fix released
- Published
Description
The GeoDirectory plugin for WordPress is vulnerable to SQL Injection via the 'post_type' parameter of the Best Of widget AJAX action (geodir_bestof) in all versions up to, and including, 2.8.198. This is due to geodir_get_widget_listings() not checking that the supplied post type is a GeoDirectory post type. The value is used to build the listing detail table name, which goes into the SELECT and JOIN clauses without quotes, and it is also concatenated into the WHERE clause without preparation. This makes it possible for unauthenticated attackers to append additional SQL to existing queries and extract sensitive information from the database.
References
- https://wpsec.com/vuln/WPSEC-2026-2112/
- https://plugins.svn.wordpress.org/geodirectory/tags/2.8.199/
- https://wordpress.org/plugins/geodirectory/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS