CVE-2026-113674

GeoDirectory < 2.8.194 - Unauthenticated Guest-Submitted Listing Modification

View on CVE.org
Published Oct 24, 2026 CVSS 3.1 · 3.7 Low EPSS < 1% KEV · Not listed
Description
The GeoDirectory WordPress plugin before 2.8.194 does not correctly verify ownership of listings submitted by logged-out users before allowing them to be edited, allowing unauthenticated attackers to modify, unpublish, attach images to, or reassign any guest-submitted listing when guest posting is enabled.

Analysis

AI-generated

Technical impact

The GeoDirectory WordPress plugin before version 2.8.194 does not correctly verify ownership of listings submitted by logged‑out users, allowing unauthenticated attackers to modify, unpublish, attach images to, or reassign any guest‑submitted listing when guest posting is enabled. This flaw represents an authorization weakness (CWE‑284) that can be exploited without authentication.

Affected Systems

WordPress sites that install the GeoDirectory plugin with a version older than 2.8.194 and have guest posting enabled are vulnerable. The flaw resides entirely in the plugin’s listing‑management component and does not depend on server or PHP configuration beyond a standard WordPress environment.

Risk and Exploitability

The vulnerability carries a CVSS score of 3.7 and an EPSS score of less than 1 %, and it is not listed in the CISA KEV catalog. Attackers can exploit the weakness by sending unauthenticated HTTP requests to the listing edit interface, targeting any guest‑submitted listing. The impact includes the ability to alter published content, remove or hide it, attach images, or change the listing’s status, potentially compromising the integrity of site content.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Upgrade the GeoDirectory plugin to version 2.8.194 or later to ensure proper ownership checks are enforced on listing edits.
  • If an upgrade is not immediately possible, disable guest posting in the plugin settings or restrict guest posting to a vetted set of publishers through WordPress role configuration.
  • Deploy a WordPress security plugin or server‑level rule (e.g., .htaccess) to block unauthenticated requests to the listing edit URLs, reducing the attack surface until the plugin can be updated or reconfigured.

Generated by OpenCVE AI on October 24, 2026 at 19:21 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories available
History
Type Values Removed Values Added
Weaknesses CWE-285
Type Values Removed Values Added
Weaknesses CWE-284
Metrics cvssV3_1

{'score': 3.7, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N'}

ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}
Type Values Removed Values Added
Weaknesses CWE-285
Type Values Removed Values Added
Description The GeoDirectory WordPress plugin before 2.8.194 does not correctly verify ownership of listings submitted by logged-out users before allowing them to be edited, allowing unauthenticated attackers to modify, unpublish, attach images to, or reassign any guest-submitted listing when guest posting is enabled.
Title GeoDirectory < 2.8.194 - Unauthenticated Guest-Submitted Listing Modification
References

Subscriptions

No data.

Weaknesses

Sources

Status
PUBLISHED
Assigner
WPScan
Published
Updated
Oct 24, 2026, 2:36 PM
Reserved
Oct 20, 2026, 2:36 PM

View source JSON

Updated
Oct 24, 2026, 2:32 PM

JSON

Status
Deferred
Published
Oct 24, 2026, 6:16 AM
Modified
Oct 26, 2026, 1:50 PM

View source JSON

No data.

Updated
Oct 24, 2026, 7:30 PM

JSON