CVE-2026-85705: WordPress Location Manager SQL Injection

CVE-2026-85705 Overview

The Location Manager plugin for WordPress contains an unauthenticated SQL injection vulnerability affecting all versions up to and including 2.3.38. Attackers can inject arbitrary SQL through the latitude and longitude REST API parameters when orderby=lat_lon is supplied. The flaw resides in the get_locations() and get_neighbourhoods() functions and impacts multiple public REST endpoints under geodir/v2/locations/, including cities, regions, countries, and neighbourhoods. Successful exploitation allows extraction of sensitive data from the WordPress database without authentication.

Critical Impact
Unauthenticated attackers can append arbitrary SQL to backend queries and exfiltrate database contents through publicly accessible REST endpoints.

Affected Products

Location Manager plugin for WordPress, all versions up to and including 2.3.38
WordPress sites using the GeoDirectory ecosystem with Location Manager installed
Publicly reachable installations exposing geodir/v2/locations/* REST routes

Discovery Timeline

2026-09-18 - CVE-2026-85705 published to the National Vulnerability Database
2026-09-18 - Last updated in NVD database

Technical Details for CVE-2026-85705

Vulnerability Analysis

The vulnerability is a classic SQL injection [CWE-89] caused by unsafe handling of user-controlled input in a WordPress REST API endpoint. The plugin accepts latitude and longitude values from unauthenticated HTTP requests and concatenates them into an ORDER BY clause when the orderby=lat_lon parameter is set. Because the SQL statement is not properly prepared and the input is not sufficiently escaped, attacker-supplied fragments alter query semantics.

The affected code paths sit inside get_locations() and get_neighbourhoods(), which back several publicly accessible endpoints: geodir/v2/locations/cities, /regions, /countries, and /neighbourhoods. All four routes are reachable without authentication, which broadens the attack surface across any exposed WordPress instance running the plugin.

Because the injection sits in an ORDER BY clause, exploitation typically relies on stacked expressions, CASE-based blind extraction, or time-based techniques rather than UNION-based reads. The confidentiality impact is high because attackers can enumerate user records, session data, and secrets stored in wp_users, wp_usermeta, and wp_options.

Root Cause

The root cause is missing use of prepared statements combined with insufficient sanitization of the latitude and longitude parameters before they are embedded in dynamic SQL. WordPress provides $wpdb->prepare() and helpers such as esc_sql(), neither of which are applied correctly along this code path.

Attack Vector

An unauthenticated remote attacker sends a crafted HTTP GET request to one of the affected REST endpoints with orderby=lat_lon and malicious payloads in latitude or longitude. The plugin then executes the tampered SQL against the WordPress database, returning inference-based or error-based signals the attacker uses to extract data.

No verified public proof-of-concept code is available. See the Wordfence vulnerability report for the technical writeup.

Detection Methods for CVE-2026-85705

Indicators of Compromise

Requests to /wp-json/geodir/v2/locations/cities, /regions, /countries, or /neighbourhoods containing orderby=lat_lon
SQL metacharacters or keywords such as SLEEP(, BENCHMARK(, UNION, SELECT, or -- within latitude or longitude query parameters
Elevated database query latency correlated with requests to the affected REST routes
Unexpected reads against wp_users or wp_options originating from the WordPress database user

Detection Strategies

Inspect web server and WordPress access logs for REST calls to the four affected endpoints paired with the orderby=lat_lon parameter
Deploy WAF signatures that flag SQL syntax in latitude and longitude parameter values
Enable MySQL general query logging temporarily to correlate suspicious REST calls with tampered ORDER BY clauses

Monitoring Recommendations

Alert on repeated 500-series responses from geodir/v2/locations/* endpoints, which can indicate error-based injection attempts
Track anomalous outbound data volumes from web tier hosts running vulnerable WordPress installations
Monitor for authentication failures or new administrator account creation immediately following requests to affected endpoints

How to Mitigate CVE-2026-85705

Immediate Actions Required

Update the Location Manager plugin to a version later than 2.3.38 as soon as the vendor publishes a patched release
Restrict access to /wp-json/geodir/v2/locations/* endpoints at the WAF or reverse proxy until the plugin is updated
Audit WordPress user, options, and secrets tables for evidence of unauthorized reads and rotate any exposed credentials or API keys

Patch Information

Refer to the vendor download page at wpgeodirectory.com for the latest Location Manager release. Review the Wordfence advisory for the fixed version reference once available.

Workarounds

Block or rate-limit unauthenticated requests to geodir/v2/locations/cities, /regions, /countries, and /neighbourhoods at the edge
Deploy WAF rules that reject requests where latitude or longitude parameters contain non-numeric characters
Disable the Location Manager plugin if it is not required for site functionality

bash

# Example nginx rule to reject non-numeric latitude/longitude parameters
if ($args ~* "(latitude|longitude)=[^0-9.\-]") {
    return 403;
}