CVE-2026-15300

Name of the Vulnerable Software and Affected Versions GEO my WP versions prior to 4.5.5

Description The plugin is susceptible to SQL Injection through the distance, lat, and lng parameters. The issue occurs because values are retrieved from $ SERVER['QUERY STRING'] using parse str(), bypassing wp magic quotes. These values are then processed by esc sql() and inserted into unquoted numeric positions within a proximity-search query generated by the gmw locations query() function in plugins/posts-locator/includes/class-gmw-wp-query.php. Since esc sql() only escapes string delimiters and the target positions are numeric, malicious payloads can bypass sanitization.

Recommendations Update to version 4.5.5.