External risk intelligence

GeoDirectory Unauthenticated SQL Injection

CVE advisorySeverity: CRITICAL (CVSS 9.3)

CVE-2026-84813

This vulnerability affects a WordPress plugin, which is typically deployed as a public-facing web application. As a directory plugin, it is designed to be accessible to website visitors over the public internet, making the vulnerable SQL injection endpoint commonly reachable in standard deployments.

SQL Injection

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A critical security vulnerability has been identified in a widely used WordPress plugin that could allow unauthorized access to sensitive information. This issue stems from an unauthenticated SQL injection flaw, meaning an attacker could potentially exploit it without needing any credentials, affecting how data is managed and protected within the affected systems. The main concern is confirming relevance and exposure to understand potential risks.

Unauthenticated data access via a common plugin.
Protects sensitive customer or business data.
Assess impact and confirm usage.

Attack Path

How an attacker could exploit the issue

An attacker can target this vulnerability by sending specially crafted requests over the network to a web application that uses the affected component. Because the vulnerability is unauthenticated, no special access is needed to reach it. If successful, an attacker could manipulate database queries, potentially leading to unauthorized data access or modification.

No authentication required.
Triggered via crafted network requests.
Risk of database manipulation.

Live Threat

Current exploitation, exposure, and threat context

This vulnerability could allow an unauthenticated attacker to inject malicious SQL code into a system using GeoDirectory, potentially leading to unauthorized access or manipulation of the underlying database. This could occur when the vulnerable functionality is accessed over the network.

Database information could be exposed.
SQL injection could occur over the network.
Data integrity and availability may be impacted.

Operational Fix

Recommended remediation, mitigation, and detection steps

This unauthenticated SQL injection in GeoDirectory affects a WordPress plugin, likely managed by the website owner or a web development team responsible for its maintenance. The first step is to identify all instances of the plugin, determine their reachability and business criticality, and then assign ownership for remediation planning.

Website owners/developers should own the issue.
Verify plugin presence and reachability.
Plan remediation based on risk.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is the GeoDirectory plugin?

GeoDirectory is a WordPress plugin used to build location-based directory websites, such as business listings, travel guides, or property portals. It functions by managing structured data within the site's database, allowing visitors to search for, filter, and view specific directory entries.

What does SQL injection mean for CVE-2026-84813?

This vulnerability falls under the weakness class of SQL Injection (CWE-89). It means the plugin does not properly sanitize user input before including it in database queries. Consequently, an attacker can manipulate these queries to communicate directly with the site's database, potentially bypassing normal application logic to read sensitive data.

How is this SQL injection triggered?

An attacker triggers this flaw by sending specially crafted web requests to the application. Because the vulnerability does not require any credentials, it can be initiated by anyone with network access to the site. It is not triggered by standard, legitimate user interactions that do not include malicious database query syntax.

Why should I care about this vulnerability?

Halo Surface Signal indicates this vulnerability is likely significant because GeoDirectory is designed to be a public-facing component. Since directory plugins are meant to be accessed by visitors over the internet, the vulnerable endpoint is commonly reachable in standard installations, increasing the likelihood of unauthorized database interaction.

Do I need to check my WordPress site for this?

Yes, if you use GeoDirectory version 2.8.174 or earlier, you should confirm if the plugin is active on your site. The first step is to perform an inventory of your environment to identify instances of the plugin and evaluate their reachability to plan for updates or necessary maintenance actions.

References

patchstack.com/database/wordpress/plugin/geodirectory/vulnerability/…

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.