CVE-2026-15300 Overview
CVE-2026-15300 is a SQL Injection vulnerability [CWE-89] in the GEO my WP plugin for WordPress affecting all versions up to and including 4.5.4. The flaw resides in the gmw_locations_query() function within plugins/posts-locator/includes/class-gmw-wp-query.php, where the distance, lat, and lng parameters are parsed directly from $_SERVER['QUERY_STRING'] via parse_str(). This parsing path bypasses wp_magic_quotes, and the values are then passed through esc_sql() before being interpolated into unquoted numeric positions in the proximity-search query. Unauthenticated attackers can inject SQL payloads through the affected parameters.
Critical Impact
Unauthenticated remote attackers can inject arbitrary SQL into the proximity-search query, enabling data manipulation and time-based extraction of sensitive database contents.
Affected Products
- GEO my WP plugin for WordPress versions up to and including 4.5.4
- Specifically the posts-locator component with gmw_locations_query()
- WordPress sites exposing proximity-search endpoints via the plugin
Discovery Timeline
- 2026-07-10 - CVE-2026-15300 published to NVD
- 2026-07-10 - Last updated in NVD database
Technical Details for CVE-2026-15300
Vulnerability Analysis
The vulnerability stems from an incorrect assumption that esc_sql() provides sufficient sanitization for numeric SQL contexts. esc_sql() only escapes string delimiters such as single quotes and backslashes. When user input is interpolated into unquoted numeric positions in a SQL statement, delimiter escaping provides no protection. Attackers can supply payloads containing SQL keywords, operators, and functions without needing to break out of a quoted context.
The affected query positions include the HAVING/SELECT clause distance math and the BETWEEN bounding-box pre-filter. A payload such as 1 OR SLEEP(3) survives esc_sql() untouched and executes as valid SQL. This creates a time-based blind SQL injection primitive that attackers can use to enumerate database contents.
Root Cause
Two compounding issues cause the vulnerability. First, the plugin reads request parameters from $_SERVER['QUERY_STRING'] and parses them with parse_str(), which bypasses WordPress's standard wp_magic_quotes handling because that function does not process $_SERVER. Second, the three parameters (distance, lat, lng) are sanitized with bare esc_sql() calls at lines 299, 300, and 301 in the 4.5.4 source, rather than being cast to numeric types.
Attack Vector
Exploitation requires no authentication and no user interaction. An attacker sends an HTTP request to a WordPress site running the vulnerable plugin, supplying malicious values in the distance, lat, or lng query-string parameters. Because the values reach the SQL query through $_SERVER['QUERY_STRING'] parsing, standard WordPress quoting protections are bypassed. Attackers can use time-based techniques such as SLEEP() to infer database contents through response-timing side channels.
See the Wordfence Vulnerability Report and the WordPress Code Review at Line 299 for technical details.
Detection Methods for CVE-2026-15300
Indicators of Compromise
- HTTP requests containing SQL keywords such as SLEEP, BENCHMARK, UNION, or SELECT in the distance, lat, or lng query-string parameters.
- Anomalously long response times on WordPress URLs that invoke the GEO my WP proximity search.
- Web-server access logs showing repeated requests to plugin endpoints with varying numeric-looking payloads.
- Unexpected outbound database queries or CPU spikes on the MySQL/MariaDB backend correlated with plugin request patterns.
Detection Strategies
- Inspect web-server access logs for query strings targeting the plugin with non-numeric characters in lat, lng, or distance parameters.
- Deploy web application firewall rules that reject non-numeric values in coordinate parameters bound for GEO my WP endpoints.
- Monitor database query logs for statements originating from gmw_locations_query() that include unexpected SQL keywords.
Monitoring Recommendations
- Enable MySQL slow-query logging to surface time-based injection attempts using SLEEP() or BENCHMARK().
- Correlate WordPress request logs with database performance telemetry to identify blind SQL injection probing.
- Alert on repeated requests from a single source to plugin proximity-search endpoints within short windows.
How to Mitigate CVE-2026-15300
Immediate Actions Required
- Upgrade the GEO my WP plugin to version 4.5.5 or later on all WordPress sites where it is installed.
- Audit database logs and WordPress access logs for evidence of exploitation attempts against distance, lat, and lng parameters.
- Rotate any secrets or credentials stored in the WordPress database if exploitation is suspected.
Patch Information
The vulnerability is fixed in GEO my WP version 4.5.5. The patch adds an upstream is_numeric() guard that short-circuits the WHERE clause to AND 1 = 0 when either coordinate is non-numeric, and replaces the three esc_sql() calls with (float) casts. Review the fixed code at the WordPress Code Review Line 286 and Line 305 references.
Workarounds
- If immediate patching is not possible, deactivate the GEO my WP plugin until the update can be applied.
- Deploy a web application firewall rule that rejects requests to proximity-search endpoints when distance, lat, or lng contain non-numeric characters.
- Restrict access to the affected endpoints via network-level controls or authentication requirements where feasible.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
