The GeoDirectory plugin for WordPress, versions earlier than 2.8.194, fails to verify listing ownership when a listing was submitted by a user who is not logged in. Because of this oversight, an attacker who is not authenticated can direct the plugin to edit, unpublish, attach images to, or reassign any guest‑submitted listing. This flaw permits unauthorized modification of content that was created by a visitor, potentially leading to data tampering, defacement, or invisible spam. The weakness represents a lack of proper authorization controls and corresponds to CWE‑285.

Affected systems are WordPress installations that use the GeoDirectory plugin with guest posting enabled and running any version older than 2.8.194. The vulnerability affects the listing management portion of the plugin and can be triggered by any unauthenticated HTTP request that targets the listing edit endpoint while guest posting is active. No specific operating system or PHP version is required beyond the normal environment that hosts WordPress.

The CVE does not publish a CVSS score or EPSS value, and it is not listed in the CISA KEV catalog, suggesting that exploitation chances are not quantitatively measured. However, the flaw is exploitable via a simple, unauthenticated request; attackers can craft URLs or use API calls to manipulate listings. The lack of ownership validation means any guest listing is within reach, so the potential damage scales with the number of visible guest listings. With guest posting commonly enabled on WordPress sites, the risk remains high for any site that still hosts legacy versions of the plugin.