CVE-2026-54831: WordPress GeoDirectory plugin <= 2.8.162 - SQL Injection vulnerability

Synopsis

An unauthenticated SQL injection vulnerability affects the WordPress GeoDirectory plugin at version 2.8.162 and below. The vulnerability is reachable over the network with no login required and no user interaction, making it trivially exploitable by any remote attacker. Successful exploitation gives an attacker read access to the underlying database and limited ability to disrupt service availability. No upstream fix has been published yet; HarborGuard is tracking the advisory and will make a patched-image rebuild available as soon as a fix version is released.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must be able to reach the WordPress installation over the network; no local or physical access is required.

• AuthenticationNot required

  No account or session token is needed; the vulnerable endpoint is fully unauthenticated.

• Victim interactionNot required

  No user action is required; the attacker sends crafted requests directly to the plugin endpoint without any social-engineering step.

• Attack complexityDetail

  Exploit conditions are straightforward and reliable, with no race conditions or environment-specific factors required to trigger the injection.

Blast Radius

• An attacker can read arbitrary database contents, including WordPress user table data such as usernames, hashed passwords, email addresses, and session tokens.
• An attacker can extract GeoDirectory listing data and any other structured content stored in the WordPress database, which may include personally identifiable information submitted by site visitors.
• The C:H/S:C scope means database reads can cross into data belonging to other applications or tenants sharing the same database server, depending on the host configuration.
• Availability impact is rated Low, meaning an attacker can cause partial service degradation, such as slowing or intermittently disrupting database-backed page responses, though a full site outage is not the expected outcome.