CVE-2026-85705

Name of the Vulnerable Software and Affected Versions Location Manager versions prior to 2.3.39

Description Unauthenticated attackers can perform SQL Injection, a technique used to manipulate database queries, by appending malicious SQL commands to existing queries to extract sensitive information. This occurs due to insufficient escaping of user-supplied parameters and lack of proper preparation of SQL queries. The issue is triggered when the orderby parameter is set to lat lon and affects the latitude and longitude variables. The affected REST endpoints include 'geodir/v2/locations/cities', '/regions', '/countries', and '/neighbourhoods', specifically within the get locations() and get neighbourhoods() functions.

Recommendations Update to a version newer than 2.3.38. Restrict access to the 'geodir/v2/locations/cities', '/regions', '/countries', and '/neighbourhoods' REST endpoints as a temporary mitigation. Avoid using the latitude and longitude parameters with orderby=lat lon until the plugin is updated.