CVE-2026-85705 AyeCode Ltd CVE debrief

Who should care

Defenders responsible for WordPress installations with the Location Manager plugin should assess exposure and prioritize verification and remediation. This includes reviewing the plugin version, restricting access to sensitive REST endpoints, and monitoring for suspicious SQL queries. Additionally, defenders should consider compensating controls for exposed systems while remediation is scheduled and verified, and track exceptions and retest remediated

Why it matters

The Location Manager plugin for WordPress is vulnerable to SQL injection, allowing unauthenticated attackers to extract sensitive information from the database. Defenders should prioritize verifying and updating the plugin to prevent potential attacks.

• Potential extraction of sensitive information from the database
• Possible disruption of database operations
• Need for verification of plugin version and exposure
• Priority for updating and patching the Location Manager plugin

Technical summary

The Location Manager plugin for WordPress is vulnerable to generic SQL Injection via 'latitude' and 'longitude' REST API Parameters in all versions up to, and including, 2.3.38 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This vulnerability allows unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. The injection is triggered when the orderby=lat_lon parameter is supplied, and affects multiple publicly accessible REST endpoints including geodir/v2/locations/cities, /regions, /countries, and /neighbourhoods via both the get_locations

Defensive priority

Defenders should prioritize verifying and updating the Location Manager plugin to prevent potential SQL injection attacks.

Recommended defensive actions

• Verify and update the Location Manager plugin to the latest version
• Restrict access to sensitive REST endpoints
• Monitor for suspicious SQL queries
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected WordPress installations with the Location Manager plugin exist in managed environments and assign an owner for follow-up

Evidence notes

The vulnerability is caused by insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. The injection is triggered when the orderby=lat_lon parameter is supplied, and affects multiple publicly accessible REST endpoints.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.