The GeoDirectory – WP Business Directory Plugin and Classified Listings Directory plugin for WordPress suffers from a time-based SQL Injection vulnerability (CWE-89) via the 'dist' parameter. Due to inadequate escaping and lack of proper query preparation, attackers can inject additional SQL commands into existing queries without authentication. This vulnerability affects all versions up to 2.8.97 and can be exploited to extract sensitive database information. The CVSS 3.1 base score is 7.5, indicating high severity with network attack vector, low attack complexity, no privileges or user interaction required, and impact on confidentiality only.

Successful exploitation allows unauthenticated attackers to perform time-based SQL Injection attacks, potentially extracting sensitive information from the plugin's database. The vulnerability does not impact integrity or availability according to the CVSS vector, but confidentiality is fully compromised.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no patch or official fix information is provided, users should monitor the vendor's communications for updates. Until a fix is available, consider disabling or restricting access to the vulnerable plugin to mitigate risk.