# GeoDirectory – WP Business Directory Plugin and Classified Listings Directory <= 2.8.198 - Unauthenticated SQL Injection via 'post_type' Parameter

- **ID:** WPSEC-2026-2112
- **Plugin:** GeoDirectory – WP Business Directory Plugin and Classified Listings Directory (`geodirectory`), https://wordpress.org/plugins/geodirectory/
- **Affected versions:** all versions before 2.8.199
- **Fixed in:** 2.8.199 (Update to 2.8.199 or later.)
- **Severity:** High 7.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N)
- **Weakness:** CWE-89
- **Usage among sites WPSec scans:** plugin Low, affected versions Low (as of 2026-10-30)
- **Attack surface analysis:** https://attacksurface.wpsec.com/plugin/geodirectory
- **Fix released:** 2026-10-29
- **Published:** 2026-10-30
- **URL:** https://wpsec.com/vuln/WPSEC-2026-2112/

## Description

The GeoDirectory plugin for WordPress is vulnerable to SQL Injection via the 'post_type' parameter of the Best Of widget AJAX action (geodir_bestof) in all versions up to, and including, 2.8.198. This is due to geodir_get_widget_listings() not checking that the supplied post type is a GeoDirectory post type. The value is used to build the listing detail table name, which goes into the SELECT and JOIN clauses without quotes, and it is also concatenated into the WHERE clause without preparation. This makes it possible for unauthenticated attackers to append additional SQL to existing queries and extract sensitive information from the database.

## References

- https://wpsec.com/vuln/WPSEC-2026-2112/
- https://plugins.svn.wordpress.org/geodirectory/tags/2.8.199/
- https://wordpress.org/plugins/geodirectory/

Source: WPSec, https://wpsec.com/vuln/WPSEC-2026-2112/

License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Free to use, share and adapt, also commercially, if you credit WPSec and link to this advisory.