CVE-2026-103913 is a SQL Injection vulnerability in the GeoDirectory – WP Business Directory Plugin and Classified Listings Directory for WordPress. The vulnerability exists in versions up to 2.8.186 due to insufficient escaping and lack of numeric validation on stored latitude/longitude coordinates. These values are directly interpolated into a distance sub-expression within the geodir_gps_query_part() function. The vulnerable code is executed by the public wp_ajax_nopriv_geodir_widget_listings handler when a request includes set_post=<pending-listing-id> and sort_by=distance_asc parameters. Authenticated attackers with Subscriber-level privileges or higher can append malicious SQL queries to extract sensitive data from the database.

An attacker with at least Subscriber-level access can exploit this vulnerability to perform SQL Injection attacks, allowing unauthorized extraction of sensitive information from the database. The vulnerability does not affect integrity or availability directly but compromises confidentiality. The CVSS 3.1 base score is 7.5 (high severity), reflecting network attack vector, low attack complexity, no privileges required for the attack vector, no user interaction, and high impact on confidentiality.

No official patch or fix is currently referenced. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict user roles and permissions to limit access to Subscriber-level or higher users, and monitor for suspicious activity related to the wp_ajax_nopriv_geodir_widget_listings AJAX handler. Avoid using affected versions in production environments if possible.