PT-2026-57075

The GEO my WP plugin for WordPress was vulnerable to SQL Injection via the 'distance', 'lat', and 'lng' parameters in versions up to, and including, 4.5.4. The values were read from $ SERVER'QUERY STRING' via parse str bypassing wp magic quotes, which does not cover $ SERVER, then passed through...