CVE-2026-54831: GeoDirectory SQL Injection Vulnerability

CVE-2026-54831 Overview

CVE-2026-54831 is an unauthenticated SQL Injection vulnerability affecting the GeoDirectory WordPress plugin in versions up to and including 2.8.162. The flaw is classified under CWE-89, Improper Neutralization of Special Elements used in an SQL Command. Remote attackers can inject arbitrary SQL statements through the plugin without any authentication or user interaction. The vulnerability carries a network attack vector with low complexity and impacts the confidentiality of backend database contents. GeoDirectory is a directory and business listing plugin used by WordPress sites to publish location-based content.

Critical Impact
Unauthenticated attackers can execute arbitrary SQL queries against the WordPress database, exposing sensitive data such as user credentials, session tokens, and configuration secrets.

Affected Products

GeoDirectory WordPress plugin versions <= 2.8.162
WordPress sites running vulnerable GeoDirectory installations
Any WordPress deployment exposing GeoDirectory endpoints to the public internet

Discovery Timeline

2026-06-26 - CVE-2026-54831 published to NVD
2026-06-26 - Last updated in NVD database

Technical Details for CVE-2026-54831

Vulnerability Analysis

The vulnerability is a classic SQL Injection flaw (CWE-89) in the GeoDirectory plugin. Attacker-controlled input reaches an SQL query construction path without proper sanitization or parameterization. The scope is marked as changed, meaning the exploit impacts resources beyond the vulnerable component, such as the WordPress database and any shared backend services. The confidentiality impact is high, while integrity is unaffected and availability sees limited disruption. Because the flaw is reachable without authentication, any internet-facing WordPress site with GeoDirectory installed is directly exposed.

Root Cause

GeoDirectory constructs SQL statements using untrusted request parameters without enforcing prepared statements or type coercion. Input values passed to database query functions are concatenated into SQL strings, allowing attackers to break out of the intended query context. Refer to the Patchstack SQL Injection Advisory for the specific parameter and code path affected.

Attack Vector

A remote attacker sends a crafted HTTP request to a vulnerable GeoDirectory endpoint. The malicious payload embeds SQL syntax such as UNION SELECT clauses or boolean-based blind injection primitives. The backend executes the injected query against the WordPress database, returning data in the response body or through inference channels. No user interaction, session, or elevated privilege is required. Attackers commonly automate exploitation using tooling such as sqlmap against known vulnerable parameters.

Detection Methods for CVE-2026-54831

Indicators of Compromise

HTTP requests to GeoDirectory endpoints containing SQL keywords such as UNION, SELECT, SLEEP, BENCHMARK, or encoded variants in query parameters.
Unusual outbound database load or slow response times correlating with requests to plugin URLs under /wp-content/plugins/geodirectory/.
Web server logs showing high volumes of GET or POST requests from a single source targeting GeoDirectory parameters.
New or unexpected reads from the wp_users or wp_options tables originating from PHP worker processes.

Detection Strategies

Deploy web application firewall (WAF) rules that flag SQL metacharacters and known injection payloads targeting GeoDirectory request paths.
Enable MySQL general query logging temporarily to identify anomalous query patterns originating from the WordPress process.
Correlate access logs with database error logs to detect syntax errors indicative of injection probing.

Monitoring Recommendations

Alert on repeated HTTP 500 responses from GeoDirectory endpoints, which often accompany injection attempts.
Monitor for outbound data exfiltration or large response payloads from WordPress hosts.
Track authentication anomalies for administrative accounts, as attackers may pivot after harvesting password hashes.

How to Mitigate CVE-2026-54831

Immediate Actions Required

Update GeoDirectory to a version later than 2.8.162 as soon as the vendor publishes a fixed release.
Restrict public access to GeoDirectory endpoints via WAF or IP allowlisting until patching is complete.
Rotate WordPress administrator credentials and any secrets stored in wp_options, assuming potential prior exposure.

Patch Information

Refer to the Patchstack SQL Injection Advisory for the latest fixed version and vendor guidance. Apply the patched release through the WordPress plugin manager or by replacing the plugin directory with the updated build.

Workarounds

Temporarily disable the GeoDirectory plugin if patching cannot be performed immediately.
Deploy WAF signatures targeting SQL Injection payloads on GeoDirectory request paths.
Restrict the database user assigned to WordPress to the minimum privileges required, blocking FILE and cross-database access.

bash

# Example WAF rule (ModSecurity) blocking common SQLi patterns on GeoDirectory endpoints
SecRule REQUEST_URI "@contains /wp-content/plugins/geodirectory/" \
    "chain,deny,status:403,id:1026548310,msg:'GeoDirectory SQLi attempt (CVE-2026-54831)'"
    SecRule ARGS "@rx (?i)(union(\s|/\*.*\*/)+select|sleep\s*\(|benchmark\s*\(|information_schema)" \
        "t:none,t:urlDecodeUni"