CVE-2026-9757: GEO my WP WordPress Plugin SQLI Vulnerability

CVE-2026-9757 Overview

CVE-2026-9757 is a SQL Injection vulnerability [CWE-89] in the GEO my WP plugin for WordPress, affecting all versions up to and including 4.5.5. The flaw resides in the gmw_get_locations_within_boundaries_sql() function, which processes the swlatlng and nelatlng parameters without proper sanitization. Unauthenticated attackers can append additional SQL queries to extract sensitive data from the WordPress database. Exploitation requires the target site to host the Posts Locator search-results shortcode [gmw form="results" form_id=N] on a public page with at least one published post containing a gmw_location row.

Critical Impact
Unauthenticated remote attackers can extract sensitive database contents, including user credentials and configuration data, via crafted query string parameters.

Affected Products

GEO my WP plugin for WordPress versions up to and including 4.5.5
WordPress sites using the Posts Locator search-results shortcode
Sites with published posts containing associated gmw_location rows

Discovery Timeline

2026-05-30 - CVE-2026-9757 published to NVD
2026-06-01 - Last updated in NVD database

Technical Details for CVE-2026-9757

Vulnerability Analysis

The vulnerability allows unauthenticated SQL injection through the swlatlng and nelatlng HTTP parameters. Attackers can manipulate the SQL BETWEEN clause used in geographic boundary queries. Successful exploitation enables time-based or UNION-based extraction of database contents, including WordPress user credentials, session tokens, and plugin secrets.

The [CWE-89] weakness stems from the plugin reading parameters from $_SERVER['QUERY_STRING'] rather than the standard WordPress superglobals. This bypasses WordPress's wp_magic_quotes protection layer entirely.

Root Cause

The root cause lies in how the plugin parses request data. The swlatlng and nelatlng parameters are extracted from $_SERVER['QUERY_STRING'] using parse_str(). WordPress's wp_magic_quotes only sanitizes $_POST, $_GET, $_COOKIE, and $_REQUEST, so values pulled directly from $_SERVER['QUERY_STRING'] remain unescaped.

Each parameter is then split on , using explode(), and the resulting fragments are interpolated directly into a SQL BETWEEN clause inside gmw_get_locations_within_boundaries_sql(). The code performs no is_numeric() validation, no (float) casting, no esc_sql() call, and no use of $wpdb->prepare().

Attack Vector

The attack vector is network-based and requires no authentication or user interaction. An attacker sends a crafted HTTP GET request to a page rendering the Posts Locator results shortcode. The malicious payload is supplied as comma-separated fragments in the swlatlng or nelatlng query string parameter.

The injected fragments break out of the BETWEEN clause and append attacker-controlled SQL. This allows blind, time-based, or UNION-based data exfiltration from the WordPress database.

For technical details, see the WordPress Plugin Code Snippet and the Wordfence Vulnerability Report.

Detection Methods for CVE-2026-9757

Indicators of Compromise

HTTP GET requests containing SQL metacharacters such as UNION, SELECT, SLEEP(, or -- inside swlatlng or nelatlng query string parameters
Unusually long or URL-encoded comma-separated values in the swlatlng or nelatlng parameters on pages hosting [gmw form="results"]
Spikes in slow database responses correlating with requests to pages using the Posts Locator shortcode
Unexpected wp_users, wp_usermeta, or wp_options table reads originating from GEO my WP query execution

Detection Strategies

Inspect web server access logs for requests containing the swlatlng= or nelatlng= parameters with non-numeric content
Enable MySQL general query logging temporarily to capture malformed BETWEEN clauses originating from gmw_get_locations_within_boundaries_sql()
Deploy WordPress-aware web application firewall rules that block SQL syntax in geographic coordinate parameters
Monitor for repeated requests with incremental payloads indicating blind or time-based SQL injection probing

Monitoring Recommendations

Alert on any HTTP request where swlatlng or nelatlng values fail a strict floating-point validation regex
Correlate slow query log entries with corresponding source IPs hitting Posts Locator pages
Track outbound DNS or HTTP requests from the database host, which may indicate out-of-band data exfiltration
Audit recent administrative account creation, password resets, and wp_options modifications

How to Mitigate CVE-2026-9757

Immediate Actions Required

Update the GEO my WP plugin to version 4.5.5.1 or later, which contains the official fix per the WordPress Plugin Changeset
Audit all pages for the [gmw form="results" form_id=N] shortcode and remove or restrict access where possible until patching is complete
Review WordPress and database logs for evidence of prior exploitation, focusing on requests with non-numeric swlatlng or nelatlng values
Rotate administrative credentials, secret keys in wp-config.php, and any API tokens stored in the database if exploitation is suspected

Patch Information

The vendor released version 4.5.5.1 of the GEO my WP plugin to address CVE-2026-9757. The fix introduces input validation and parameterization for the swlatlng and nelatlng values before they reach the SQL BETWEEN clause. See the WordPress Plugin Version Changes diff for the complete code changes.

Workarounds

Remove the Posts Locator search-results shortcode [gmw form="results" form_id=N] from all publicly accessible pages until the plugin is updated
Deploy a web application firewall rule rejecting requests where swlatlng or nelatlng query string values do not match a strict pattern of two comma-separated floats
Restrict access to Posts Locator pages using authentication or IP allow-listing where business requirements permit
Apply database least-privilege principles so the WordPress database user cannot read sensitive tables outside the WordPress schema

bash

# Example WAF rule (ModSecurity) rejecting non-numeric coordinate parameters
SecRule ARGS:swlatlng "!@rx ^-?\d+(\.\d+)?,-?\d+(\.\d+)?$" \
    "id:1009757,phase:2,deny,status:403,msg:'CVE-2026-9757 GEO my WP SQLi attempt'"
SecRule ARGS:nelatlng "!@rx ^-?\d+(\.\d+)?,-?\d+(\.\d+)?$" \
    "id:1009758,phase:2,deny,status:403,msg:'CVE-2026-9757 GEO my WP SQLi attempt'"