CVE-2026-103913

Name of the Vulnerable Software and Affected Versions GeoDirectory versions prior to 2.8.187

Description Insufficient escaping and a lack of numeric validation on coordinate values when saving a listing allow authenticated attackers with Subscriber-level access or higher to perform SQL Injection. The issue occurs when values are directly interpolated into a distance sub-expression within the geodir gps query part() function. This is triggered via the wp ajax nopriv geodir widget listings handler when the set post and sort by parameters are used, enabling the extraction of sensitive database information.

Recommendations Update GeoDirectory to a version later than 2.8.186.