CVE-2026-32368

High

Published: 13 March 2026

Published

13 March 2026

Modified

22 April 2026

KEV Added

—

Patch

—

CVSS Score v3.1 8.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:L

EPSS Score 0.0023 13.3th percentile

Risk Priority 55 floored blend · peak EPSS

Summary

CVE-2026-32368 is a high-severity SQL Injection (CWE-89) vulnerability. Its CVSS base score is 8.5 (High).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 13.3th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).

Deeper analysis

CVE-2026-32368 is an Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability that enables Blind SQL Injection in the delphiknight Geo to Lat (geo-to-lat) WordPress plugin. This issue affects all versions of the plugin from n/a through 1.0.19.

The vulnerability carries a CVSS v3.1 base score of 8.5 (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:L), indicating it can be exploited remotely over the network with low complexity by low-privileged authenticated users, such as WordPress subscribers, without requiring user interaction. Attackers can achieve high confidentiality impact by extracting sensitive data through blind SQL injection techniques, alongside low availability impact and a change in scope that elevates the consequences.

The Patchstack advisory at https://patchstack.com/database/Wordpress/Plugin/geo-to-lat/vulnerability/wordpress-geo-to-lat-plugin-1-0-19-sql-injection-vulnerability?_s_id=cve documents this SQL injection vulnerability in the WordPress Geo to Lat plugin version 1.0.19.

OWASP Top 10 for Web (2025)

EU & UK References

🇪🇺 ENISA EUVD: EUVD-2026-11863

Vulnerability details

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in delphiknight Geo to Lat geo-to-lat allows Blind SQL Injection.This issue affects Geo to Lat: from n/a through <= 1.0.19.

CWE(s): CWE-89

Related Threats

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access

Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.

attack.mitre.org →

T1005 Data from Local System Collection

Adversaries may search local system sources, such as file systems, configuration files, local databases, virtual machine files, or process memory, to find files of interest and sensitive data prior to Exfiltration.

attack.mitre.org →

Why these techniques?

SQL injection in public-facing WordPress plugin directly enables T1190 (exploit of public-facing app for initial/remote access) and T1005 (extraction of sensitive data from local system/DB via blind SQLi queries).

Confidence: HIGH · MITRE ATT&CK Enterprise v19.0