CVE-2026-39512: GeoDirectory SQLi Vulnerability

CVE-2026-39512 Overview

CVE-2026-39512 is an unauthenticated SQL injection vulnerability affecting the GeoDirectory WordPress plugin in versions up to and including 2.8.152. The flaw is classified under CWE-89, Improper Neutralization of Special Elements used in an SQL Command. Attackers can exploit the vulnerability over the network without authentication or user interaction. The issue carries a CVSS 3.1 base score of 9.3 and a changed scope, meaning a successful attack impacts resources beyond the vulnerable component.

Critical Impact
Remote, unauthenticated attackers can inject SQL statements against any WordPress site running GeoDirectory 2.8.152 or earlier, exposing database contents and degrading service availability.

Affected Products

GeoDirectory WordPress plugin versions <= 2.8.152
WordPress sites with the GeoDirectory plugin installed and active
Hosting environments serving vulnerable GeoDirectory deployments

Discovery Timeline

2026-06-15 - CVE-2026-39512 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2026-39512

Vulnerability Analysis

The vulnerability resides in the GeoDirectory plugin's handling of user-supplied input that flows into SQL queries. Attacker-controlled data reaches the database layer without proper sanitization or parameterization. Because the endpoint does not require authentication, any remote actor capable of reaching the WordPress site can trigger the injection.

The CVSS vector indicates a changed scope and confidentiality impact rated High, alongside Low availability impact. This means a successful exploit can read arbitrary database contents — including WordPress wp_users hashes, session tokens, and plugin secrets — and disrupt query execution. Integrity impact is rated None, which suggests direct write paths are not exposed through this injection vector.

Further technical context is documented in the Patchstack SQL Injection Advisory.

Root Cause

The root cause is improper neutralization of special characters in an SQL statement [CWE-89]. GeoDirectory concatenates request parameters into a SQL query without using prepared statements or the WordPress $wpdb->prepare() API. This permits an attacker to break out of the intended query context and append arbitrary clauses such as UNION SELECT.

Attack Vector

Exploitation requires only network access to a WordPress site running the vulnerable plugin. The attacker crafts an HTTP request containing a malicious payload in a parameter consumed by the affected GeoDirectory handler. No credentials, privileges, or user interaction are required. Successful payloads can enumerate database schemas, extract administrator credentials, and pivot to broader site compromise once hashes are cracked.

No public proof-of-concept exploit code is currently referenced in the advisory.

Detection Methods for CVE-2026-39512

Indicators of Compromise

HTTP requests to GeoDirectory endpoints containing SQL metacharacters such as ', ", --, ;, UNION, SELECT, or SLEEP(
Unusual database error messages logged by WordPress or the underlying MySQL/MariaDB instance
Outbound queries returning unexpectedly large result sets correlated with GeoDirectory request paths
New or unknown WordPress administrator accounts appearing after suspicious request bursts

Detection Strategies

Inspect web server access logs for GeoDirectory request parameters containing URL-encoded SQL syntax (%27, %20UNION%20, %20SELECT%20)
Enable WordPress debug logging or a database query logger to capture malformed queries originating from the plugin
Deploy WAF signatures targeting CWE-89 patterns scoped to the GeoDirectory plugin path
Correlate request anomalies with database CPU spikes or slow query log entries

Monitoring Recommendations

Monitor for repeated 500-series HTTP responses from GeoDirectory endpoints indicating injection probing
Alert on time-based payload signatures such as SLEEP, BENCHMARK, or WAITFOR DELAY in request parameters
Track WordPress audit logs for privilege changes and new user creation following anomalous request activity
Baseline normal GeoDirectory traffic to identify outliers in parameter length, character distribution, and request frequency

How to Mitigate CVE-2026-39512

Immediate Actions Required

Update the GeoDirectory plugin to a version newer than 2.8.152 as soon as a fixed release is published by the vendor
Audit WordPress administrator accounts and rotate all administrator credentials and API keys
Review database query logs for evidence of prior exploitation against GeoDirectory endpoints
Restrict access to GeoDirectory administrative URLs to known IP ranges where feasible

Patch Information

At the time of publication, refer to the Patchstack SQL Injection Advisory for the latest patch status and fixed version information. Verify the installed plugin version through the WordPress admin Plugins page after applying any update.

Workarounds

Deactivate the GeoDirectory plugin until a patched version is available if the site can operate without it
Deploy a Web Application Firewall rule blocking SQL syntax in GeoDirectory request parameters
Restrict the WordPress database user privileges to remove FILE, CREATE, and unnecessary WRITE grants
Place the affected endpoints behind authentication or IP allow-lists using web server configuration

bash

# Example nginx rule blocking common SQL injection patterns on GeoDirectory paths
location ~* /wp-content/plugins/geodirectory/ {
    if ($args ~* "(union.*select|sleep\(|benchmark\(|--|;|0x[0-9a-f]+)") {
        return 403;
    }
}