VulnSocial

CVE-2026-9757Disclosure

LOWCVSS 7.5 · HIGH

Exploit discussion active in current signal (1 latest mentions)

Immediate actions

  • Hunt for exploitation attempts and persistence artifacts
  • Increase monitoring for publicly documented tradecraft
  • Track advisory updates for patch or workaround availability

Recommended action window: High priority (within 72h)

NVD description

The GEO my WP plugin for WordPress is vulnerable to SQL Injection via the 'swlatlng' and 'nelatlng' parameters in all versions up to, and including, 4.5.5 The parameters are read from $_SERVER['QUERY_STRING'] via parse_str() (bypassing WordPress's wp_magic_quotes protection, which only covers $_POST/$_GET/$_COOKIE/$_REQUEST), then each is split on ',' via explode() and the resulting fragments are interpolated directly into a SQL BETWEEN clause in gmw_get_locations_within_boundaries_sql() without is_numeric() validation, (float) casting, esc_sql(), or $wpdb->prepare(). This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. Exploitation requires the site to host the Posts Locator search-results shortcode (`[gmw form="results" form_id=N]`) on a public page and to have at least one published post with an associated gmw_location row.

Back to dashboard
1.5/ 10 priority

Sources & remediation

Other references
Weakness type (CWE)
CWE-89

Priority

LOW

Exploitation

NONE

PoC

YES

Patch

NONE

Momentum

STABLE

Threat summary

  • Public PoC is present in monitored signal
  • 5 mentions across 3 observed days
  • Momentum state: stable

What's happening

  • PoC mentioned or linked in 1 signal
  • Technical details provided in 5 signals
  • Disclosure: 3 classified signals
  • General: 1 classified signal
  • Peaked 2d ago at 3 mentions (2026-05-30); latest day: 1
  • 5 total mentions across 3 days

Deep dive

Activity timeline5 mentions / 3d
01223Mentions · 2026-05-30: 3Mentions · 2026-06-09: 1Mentions · 2026-06-21: 1PoC Mentioned / Linked · 2026-06-09: 1Technical Details · 2026-05-30: 3Technical Details · 2026-06-09: 1Technical Details · 2026-06-21: 105-3006-0906-21
Signal classification3 categories
Disclosure
360.0%
PoC
120.0%
General
120.0%
Referenced assets5 URLs
Classification over time
DateTotalLabels
2026-05-303
Disclosure3
2026-06-091
PoC1
2026-06-211
General1
Full discourse5 posts
  • Hugo | DevOps | Cybersecurity 🇱🇻@HugoValters
    PoC

    ACTIVE THREAT: If your WordPress site runs the 'GEO' plugin (<= 4.5.5), you are vulnerable to a CVSS 7.5 SQL Injection. (CVE-2026-9757) I've documented the exploit payload and built a Docker Test Lab so you can safely verify your infrastructure. #cybersecurity #infosec #CVE https://t.co/zyb8s6gtRB

    Post summary

    The tweet announces a SQL injection in the GEO plugin (CVE‑2026‑9757), offers an exploit payload and Docker test lab for verification, but does not report active exploitation or provide patches.

    1001069
    920 followersView on X
  • CVE@CVEnew
    Disclosure

    CVE-2026-9757 The GEO my WP plugin for WordPress is vulnerable to SQL Injection via the 'swlatlng' and 'nelatlng' parameters in all versions up to, and including, 4.5.5 The parameter… https://www.cve.org/CVERecord?id=CVE-2026-9757

    Post summary

    The text discloses a SQL Injection vulnerability in the GEO my WP WordPress plugin up to version 4.5.5 affecting the 'swlatlng' and 'nelatlng' parameters.

    00010215
    57.6K followersView on X
  • IntegSec@integ_sec
    General

    CVE-2026-9757: GEO my WP WordPress Plugin SQL Injection Bug - What It Means for Your Business and How to Respond https://hubs.li/Q04m5kCh0

    Post summary

    The headline references a SQL injection flaw in the GEO my WP WordPress plugin, but offers no evidence of available PoC, exploit, or mitigation details within the supplied text.

    0000038
    31 followersView on X
  • Infoflowcloud@infoflowcloud
    Disclosure

    🚨*CVE* CVE-2026-9757 The GEO my WP plugin for WordPress is vulnerable to SQL Injection via the 'swlatlng' and 'nelatlng' parameters in all versions up to, and including, 4.5.5 The parameter… https://www.cve.org/CVERecord?id=CVE-2026-9757 ----- Traducción: CVE-2026-9757 El … http://infoflow.cloud`

    Post summary

    The post announces CVE-2026-9757, a SQL injection flaw in the GEO my WP WordPress plugin, identifying the vulnerable parameters and linking to the official CVE record.

    0000037
    79 followersView on X
  • Vulmon Vulnerability Feed@VulmonFeeds
    Disclosure

    CVE-2026-9757 SQL Injection in GEO my WP Plugin for WordPress Versions Up to 4.5... https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-9757 Customizable Vulnerability Alerts: https://alerts.vulmon.com/?utm_source=twitter&utm_medium=social&utm_campaign=2102281&utm_content=4

    Post summary

    A tweet announced CVE‑2026‑9757, an SQL injection in GEO my WP Plugin up to version 4.5, and linked to a Vulmon vulnerability details page and customizable alerts, but no PoC, exploit code, or patch information was provided.

    0000059
    4.0K followersView on X

Explore more

Back to dashboard