CVE-2026-52715: WordPress GEO my WordPress plugin <= 4.5.5 - SQL Injection vulnerability

Synopsis

An unauthenticated SQL injection vulnerability affects the GEO my WordPress plugin at version 4.5.5 and earlier. The flaw is reachable over the network with no authentication required, and the attack succeeds reliably with no victim interaction needed. Successful exploitation gives an attacker read access to database contents and can partially disrupt service availability. HarborGuard tracks this advisory and will make a patched-image rebuild available the moment an upstream fix is published.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The vulnerable plugin endpoint is exposed over the network, so an attacker must be able to reach the WordPress HTTP service to exploit it.

• AuthenticationNot required

  No account or session credentials are needed; the injection can be triggered by any unauthenticated HTTP request.

• Victim interactionNot required

  The attacker does not need to involve or deceive any user; the request is sent directly to the server.

• Attack complexityDetail

  The exploit is reliable and condition-free: no race conditions, memory layout dependencies, or special environmental factors are required.

Blast Radius

• Reads database contents including stored user records, geolocation data, plugin configuration, and any other tables accessible to the WordPress database user.
• Sensitive values such as password hashes, email addresses, and session tokens stored in the database are exposed to the attacker.
• Availability is partially degraded: the injection can produce malformed or resource-intensive queries that disrupt normal plugin and site operation.
• The scope is changed (CVSS S:C), meaning the impact can extend beyond the WordPress application itself to other data or services sharing the same database instance.