Technical impact
The GeoDirectory WordPress plugin before version 2.8.194 fails to properly escape administrator‐defined text before writing that data into a generated PHP file located within the plugin’s own directory. This omission is a Code Injection flaw (CWE‑94). A sub‑site administrator can embed arbitrary PHP code in the exported data; when the plugin creates the file, the code is saved and any visitor can trigger it, resulting in full remote code execution on the host.
Affected Systems
All installations of the GeoDirectory WordPress plugin running any version older than 2.8.194 are affected, regardless of the WordPress core version or server environment. The vulnerability is active only when the plugin is enabled and the database text export feature is used by a subsite administrator on a multisite network.
Risk and Exploitability
The vulnerability is not yet in the CISA KEV catalog, but the attack conditions are simple: a user with sub‑site administrative rights can craft malicious text that is written to a PHP file, after which any visitor can execute the code. Because the attacker’s code runs on the server and is publicly reachable, the risk remains high and the potential for widespread exploitation on multisite WordPress deployments is significant. The EPSS score of <1% indicates a very low probability of automated exploitation, yet the vulnerability can still be used manually. The CVSS score of 7.2 indicates high severity.
