CVE-2026-9757 is an SQL Injection vulnerability in the GEO my WP WordPress plugin affecting all versions up to 4.5.5. The issue arises because the 'swlatlng' and 'nelatlng' parameters are extracted from $_SERVER['QUERY_STRING'] using parse_str(), bypassing WordPress's wp_magic_quotes protections. These parameters are then split and directly interpolated into a SQL BETWEEN clause in the gmw_get_locations_within_boundaries_sql() function without numeric validation, casting, escaping, or prepared statements. This improper neutralization of special elements (CWE-89) enables unauthenticated attackers to append malicious SQL code to queries, risking unauthorized data disclosure. Exploitation requires the presence of a public page with the Posts Locator shortcode and at least one published post with location data.

Successful exploitation allows unauthenticated attackers to perform SQL Injection attacks, enabling them to extract sensitive information from the database. The vulnerability does not affect data integrity or availability directly but compromises confidentiality. The attack surface requires specific plugin usage conditions, including a public page with the Posts Locator shortcode and existing location data. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, administrators should consider removing or disabling the Posts Locator shortcode on public pages or restricting access to affected pages to trusted users. Monitoring for unusual database queries related to these parameters may help detect exploitation attempts. Avoid relying on WordPress's wp_magic_quotes for query string parameters, and consider applying manual input validation or using a web application firewall to block suspicious requests targeting 'swlatlng' and 'nelatlng' parameters.