SQL Injection in Ninjew Geo My Wp
CVE-2026-15300
The GEO my WP plugin for WordPress was vulnerable to SQL Injection via the 'distance', 'lat', and 'lng' parameters in versions up to, and including, 4.5.4. The values were read from $_SERVER['QUERY_STRING'] via parse_str() (bypassing wp_ma…
Vulnerability class: SQL Injection
CVSS v3 metric
CVSS v3 base score 9.1 (Critical). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H.
Affected products
- Ninjew Geo My Wp — versions 0
Weakness classification (CWE)
References
Frequently asked questions
- What is CVE-2026-15300?
- CVE-2026-15300 is a critical-severity vulnerability in Ninjew Geo My Wp, classified under SQL Injection. CVSS score: 9.1/10. Published 2026-07-10.
- How severe is CVE-2026-15300?
- Critical severity. CVSS v3 base score is 9.1 out of 10.