The GeoDirectory plugin up to version 2.8.161 allows a Server Side Request Forgery (SSRF) flaw that is classified as CWE-918. An attacker can trigger the plugin to send arbitrary HTTP requests from the host server, potentially exposing internal IP addresses, sensitive files, or retrieving data from external services. The vulnerability manifests through an endpoint that accepts user input and passes it to a URL fetch routine without sufficient validation.

Any WordPress site that has installed the GeoDirectory plugin version 2.8.161 or earlier is exposed. The plugin is developed by Paolo, and the vulnerability affects all such installations regardless of site configuration, as long as the endpoint remains accessible to users who have subscription-level permissions.

The CVSS score of 6.4 indicates moderate severity, yet the EPSS score of less than 1% signals a low probability of exploitation seen to date. The vulnerability is not listed in CISA KEV. Attackers can exploit the flaw by crafting a request to the plugin’s endpoint; the data indicates that authenticated subscribers can initiate such requests. The lack of visible restrictions suggests that the primary requirement for exploitation is the ability to supply crafted URLs to the endpoint, making it potentially accessible to users with subscriber privileges.