CVE-2026-103913 paoltaia CVE debrief

Who should care

Defenders responsible for WordPress installations with the GeoDirectory plugin should assess exposure and verify the integrity of their database. This vulnerability allows authenticated attackers with Subscriber-level access and above to append additional SQL queries to extract sensitive information from the database.

Why it matters

CVE-2026-103913 is a SQL Injection vulnerability in the GeoDirectory plugin for WordPress that allows authenticated attackers to extract sensitive information from the database. Defenders should prioritize verifying exposure and assessing database integrity.

• Potential extraction of sensitive information from the database
• Possible disruption of database integrity
• Need for verification of GeoDirectory plugin versions and database integrity
• Requirement for monitoring suspicious database activity

Technical summary

The GeoDirectory plugin for WordPress is vulnerable to SQL Injection via stored latitude/longitude coordinates of a listing in versions up to, and including, 2.8.186. This is due to insufficient escaping and the absence of numeric validation on coordinate values when a listing is saved, combined with direct string interpolation of those values into a distance sub-expression in geodir_gps_query_part() that is later executed by the public wp_ajax_nopriv_geodir_widget_listings handler.

Defensive priority

Defenders should prioritize verifying exposure of GeoDirectory plugin versions up to 2.8.186 and assess the integrity of their database.

Recommended defensive actions

• Verify exposure of GeoDirectory plugin versions up to 2.8.186
• Assess the integrity of the database
• Restrict access to sensitive database information
• Monitor for suspicious database activity
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented

Evidence notes

The CVE record and NVD entry provide details on the SQL Injection vulnerability in the GeoDirectory plugin. However, the corpus does not establish versions beyond 2.8.186, exploitation, impact, or remediation, which require verification from official sources.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.