POC-GeoLeak-CVE-2026-52715

PoC funcional de CVE-2026-52715 (GeoLeak): SQLi no autenticada en GEO my WordPress <= 4.5.5 via swlatlng/nelatlng. Laboratorio Docker + exploit time-based/boolean-based + exfiltracion sin comas en payload.

The chain dubbed GeoLeak demonstrates how, starting from read-only access to any public page containing the [gmw] shortcode, an attacker can:

1. Inject arbitrary SQL through the swlatlng (or nelatlng) query string parameter, without cookies, nonce, or authentication.
2. Force measurable delays with SLEEP() (time-based blind) evaluated for each row of the INNER JOIN against wp_gmw_locations.
3. Use the "total_results":N oracle that the plugin itself embeds in the map configuration JSON to infer boolean conditions (boolean-based blind).
4. Exfiltrate the entire database character by character, bypassing the restriction that the payload cannot contain commas (PHP splits the value with explode(',', ...)), using CASE WHEN and SUBSTRING(x FROM n FOR 1).

The result is arbitrary read access to the WordPress database: the wp_users table (password hashes), configuration options, keys, and third-party data stored in plugins.

The PoC verifies the complete extraction of MariaDB's VERSION() using only GET requests.

Legal Notice

This repository contains strictly educational and defensive material.

• Purpose: demonstrate the exploitation chain for training, self-auditing, and patch validation purposes.
• Authorized use: run it only against systems you own or for which you have explicit written authorization. The included Docker lab is the only intended environment.
• Prohibited: any use against third-party systems without consent. The repository author is not responsible for misuse of the material included here.
• Responsibility: the operator is solely responsible for compliance with applicable legislation (LOPD/GDPR in Spain, CFAA in the US, etc.).

Chain Architecture

Requirements

• Docker and Docker Compose (tested with Docker 29.4.1 / Compose v5.2.0)
• curl and awk for the exploit
• Port 3080 free (or change the mapping in docker-compose.yml)

Repository Structure

Quick Start Guide

Configurable exploit parameters:

WordPress access: http://localhost:3080 with admin/admin. The page with the vulnerable form is http://localhost:3080/?page_id=5.

Note: the seed row in wp_gmw_locations is essential. The query uses INNER JOIN against that table: without rows the injected WHERE is not evaluated and SLEEP() does not sleep.

Exploitation Verification

Real output from the last run against the lab (August 14, 2026):

Cross-check directly against the database:

Against the patched version (>= 4.5.5.1) the time-based phase responds in milliseconds and the PoC ends with [-] No se detecto retardo (objetivo posiblemente parcheado >= 4.5.5.1).

Technical Analysis

Complete detail, with code snippets and exact lines, in docs/analisis-tecnico.md. Key points:

• Sink: gmw_get_locations_within_boundaries_sql() interpolates {$sw[0]}, {$sw[1]}, {$ne[0]}, {$ne[1]} directly into the WHERE (all four points are injectable).
• Source: gmw_get_form_values() processes the entire query string with parse_str() without an allowlist.
• Exploit restriction: the payload cannot contain commas because PHP does explode(',', $southwest). The PoC uses CASE WHEN a THEN b ELSE c END instead of IF(a,b,c) and SUBSTRING(x FROM n FOR 1) instead of SUBSTRING(x,n,1).
• Boolean oracle: the map's embedded JSON exposes "total_results":N; the exploit calibrates the length range (-10..1) so the seed row survives when the condition is true.
• Techniques: time-based and boolean-based verified; UNION-based theoretical (the wp_posts.* columns plus the gmw fields must be aligned); error-based impractical (wpdb silences errors).
• Discarded AJAX endpoints: the plugin's three wp_ajax_nopriv_* handlers either do not execute SQL (free version) or are protected by a nonce. The CVE vector in the free version is the form GET.

The Official Patch (4.5.5.1)

Complete real diff in docs/diff-parche-4.5.5.1-gmw-functions.php.diff. Between 4.5.5 and 4.5.5.1 only three files differ (geo-my-wp.php for the version, readme.txt for the changelog, and includes/gmw-functions.php):

1. New validator function gmw_parse_latlng_boundary(): requires exactly 2 finite numeric parts with |lat| <= 90 and |lng| <= 180.
2. gmw_get_form_values() discards non-validating values with unset().
3. The sink is rewritten with $wpdb->prepare() and %f placeholders.

Current plugin version: 4.5.5.3 (July 2026), patched.

Mitigation

1. Update to GEO my WordPress >= 4.5.5.1 (main measure).
2. If it cannot be updated immediately: WAF rule blocking non-numeric values in swlatlng/nelatlng, or virtual patching (Patchstack and similar).
3. Review whether public [gmw] forms need map-boundary search.
4. Monitor accesses with abnormal swlatlng/nelatlng patterns in the logs.
5. If the site was exposed: rotate secrets and reconsider wp_users hashes — the injection allows reading them.

Credits

• Discovery: researcher alvarodh5 (reported on April 10, 2026, published on June 15, 2026 via Patchstack).
• Patchstack entry
• NVD record for CVE-2026-52715
• GEO my WordPress on wordpress.org

License

MIT