CVE-2026-9757 is an SQL Injection vulnerability in the GEO my WP plugin for WordPress, affecting all versions up to 4.5.5. The issue arises because the 'swlatlng' and 'nelatlng' parameters are extracted from $_SERVER['QUERY_STRING'] using parse_str(), bypassing WordPress's usual input protections. These parameters are then split and directly interpolated into a SQL BETWEEN clause without numeric validation, casting, escaping, or prepared statements. This improper neutralization of special elements (CWE-89) enables unauthenticated attackers to append malicious SQL queries, potentially exposing sensitive database data. Exploitation requires the presence of the Posts Locator shortcode on a public page and at least one published post with a location record.

Successful exploitation allows unauthenticated attackers to perform SQL Injection attacks, enabling them to extract sensitive information from the database. The vulnerability does not affect integrity or availability directly but compromises confidentiality. The CVSS v3.1 base score is 7.5 (High), reflecting network attack vector, low attack complexity, no privileges required, no user interaction, and high confidentiality impact.

Patch status is not yet confirmed — no official fix or patch is currently available for this vulnerability. Users should monitor the vendor's advisory for updates. Until a patch is released, avoid publicly exposing pages that use the Posts Locator search-results shortcode or restrict access to such pages to trusted users only. Additionally, consider implementing web application firewall (WAF) rules to detect and block suspicious SQL injection attempts targeting the 'swlatlng' and 'nelatlng' parameters.