Description
The The GeoDirectory – WP Business Directory Plugin and Classified Listings Directory plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 2.8.198 This is due to the software allowing users to execute an action that does not properly validate a value before running do_shortcode. This makes it possible for unauthenticated attackers to execute arbitrary shortcodes.
Published: 2026-10-30
Score: 6.5 Medium
EPSS: n/a
KEV: No
Impact: Remote Code Execution via Unauthenticated Shortcode Injection
Action: Immediate Patch
AI Analysis

Impact

The GeoDirectory plugin passes the pagination_info parameter directly to WordPress’s do_shortcode function without sanitizing it, allowing attackers to inject and execute arbitrary shortcodes. This flaw can lead to remote code execution and full compromise of a WordPress site. The weakness is classified as an injection vulnerability (CWE-94).

Affected Systems

All releases of the GeoDirectory – WP Business Directory Plugin and Classified Listings Directory up to version 2.8.198 include the flaw. Any WordPress site that has the plugin installed and running on a vulnerable version, regardless of user authentication status, is at risk.

Risk and Exploitability

The CVSS score of 6.5 indicates moderate severity. The EPSS score is not available and the vulnerability is not listed in the CISA KEV catalog; however, the nature of the flaw permits attackers to trigger it remotely through unauthenticated HTTP requests. Because no credentials are required, the potential impact spans the entire site and depends on the payload supplied in the shortcode.

Generated by OpenCVE AI on October 30, 2026 at 18:39 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Update the GeoDirectory plugin to the latest version that includes the fix (version 2.8.199 or later).
  • If an update cannot be applied immediately, remove or disable the pagination_info parameter handling or configure WordPress to restrict shortcode execution to authenticated users only.
  • Use a web application firewall or WordPress security plugin to block or sanitize requests that attempt to exploit the pagination_info parameter.

Generated by OpenCVE AI on October 30, 2026 at 18:39 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Fri, 30 Oct 2026 19:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Fri, 30 Oct 2026 17:30:00 +0000

Type Values Removed Values Added
Description The The GeoDirectory – WP Business Directory Plugin and Classified Listings Directory plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 2.8.198 This is due to the software allowing users to execute an action that does not properly validate a value before running do_shortcode. This makes it possible for unauthenticated attackers to execute arbitrary shortcodes.
Title GeoDirectory <= 2.8.198 - Unauthenticated Shortcode Injection via 'pagination_info' Parameter
Weaknesses CWE-94
References
Metrics cvssV3_1

{'score': 6.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N'}

Subscriptions

No data.

cve-icon MITRE

Status: PUBLISHED

Assigner: Wordfence

Published:

Updated: 2026-10-30T18:08:58.837Z

Reserved: 2026-10-28T17:16:33.600Z

Link: CVE-2026-118635

cve-icon Vulnrichment

Updated: 2026-10-30T18:01:51.956Z

cve-icon NVD

Status : Deferred

Published: 2026-10-30T18:17:24.393

Modified: 2026-10-30T19:18:18.780

Link: CVE-2026-118635

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-30T18:45:14Z

Weaknesses
  • CWE-94

    Improper Control of Generation of Code ('Code Injection')