GeoLeak

An educational proof of concept of the GeoLeak chain (CVE-2026-52715): an unauthenticated SQL injection (CWE-89) in the gmw_get_locations_within_boundaries_sql() function of the GEO my WordPress plugin, affecting all versions <= 4.5.5 and patched since 4.5.5.1 (June 15, 2026). With read access to any public page using the [gmw] shortcode, an attacker injects arbitrary SQL through swlatlng/nelatlng with no cookies or nonce: forcing measurable delays with SLEEP() (time-based), using the "total_results":N oracle embedded by the plugin in the map JSON (boolean-based) and exfiltrating the whole database char by char while bypassing the no-comma restriction (PHP splits the value with explode(",")) via CASE WHEN and SUBSTRING(x FROM n FOR 1). Includes a self-contained Docker lab (WordPress 6.8 + MariaDB 11), a technical analysis of the chain and of the official 4.5.5.1 patch. For educational and research purposes only.