Input validation vulnerability in GeoDirectory – WordPress Business Directory Plugin, or Classified Directory 2.3.29

The GeoDirectory – WordPress Business Directory Plugin, or Classified Directory plugin for WordPress, is vulnerable to a type of attack called SQL Injection in all versions up to 2.3.29. This vulnerability exists because the plugin does not properly escape a user-provided parameter and also does not properly prepare an existing SQL query. If an attacker with administrator access is able to exploit this vulnerability they may be able to gain access to sensitive information stored in the plugin’s database.