CVE-2026-113673 GeoDirectory CVE debrief

Who should care

Defenders responsible for WordPress installations, especially those using the GeoDirectory plugin, should assess exposure and prioritize patching or mitigation. This includes administrators of multisite networks and security teams responsible for monitoring and incident response.

Why it matters

CVE-2026-113673 is a Remote Code Execution vulnerability in the GeoDirectory WordPress plugin. Defenders should prioritize patching, especially in environments with high privilege users who cannot otherwise run code. The vulnerability allows unauthenticated visitors to trigger RCE, making it a critical concern for WordPress administrators and security teams.

• Potential Remote Code Execution by unauthenticated visitors
• Elevation of privileges for high privilege users with limited coding capabilities
• Possible exploitation through specially crafted requests

Technical summary

The GeoDirectory WordPress plugin before 2.8.194 does not properly escape administrator-defined text before writing it into a generated PHP file. This allows high privilege users, such as subsite administrators on a multisite network, to achieve Remote Code Execution (RCE) that can be triggered by any unauthenticated visitor. The vulnerability can be exploited through specially crafted requests, and defenders should prioritize patching or mitigating this vulnerability, especially in environments where high privilege users with limited coding capabilities are present.

Defensive priority

Defenders should prioritize patching or mitigating this vulnerability, especially in environments where high privilege users with limited coding capabilities are present.

Recommended defensive actions

• Patch the GeoDirectory WordPress plugin to version 2.8.194 or later
• Restrict access to high privilege users on multisite networks
• Monitor for suspicious activity on affected systems
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The vulnerability was reported by WPScan, and the CVE record is based on information from the NVD and CVE Program. The GeoDirectory WordPress plugin before 2.8.194 does not properly escape administrator-defined text before writing it into a generated PHP file, allowing high privilege users such as a subsite administrator on a multisite network, who cannot otherwise run code, to achieve Remote Code Execution that any unauthenticated visitor can trigger. Evidence is limited to public sources and may not reflect the full scope or impact.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.