CVE-2026-113674 GeoDirectory CVE debrief

Who should care

Defenders of WordPress installations using the GeoDirectory plugin, especially those with guest posting enabled, should assess exposure and verify ownership verification of guest-submitted listings.

Why it matters

CVE-2026-113674 allows unauthenticated attackers to modify guest-submitted listings in the GeoDirectory WordPress plugin. Defenders of WordPress installations using this plugin, especially with guest posting enabled, should assess exposure and verify ownership verification of guest-submitted listings. The impact of this vulnerability requires verification from official sources, and remediation steps are not yet established.

• Unauthenticated attackers can modify guest-submitted listings
• Unauthenticated attackers can unpublish guest-submitted listings
• Unauthenticated attackers can attach images to guest-submitted listings
• Unauthenticated attackers can reassign guest-submitted listings

Technical summary

The GeoDirectory WordPress plugin before 2.8.194 does not correctly verify ownership of listings submitted by logged-out users before allowing them to be edited. This allows unauthenticated attackers to modify, unpublish, attach images to, or reassign any guest-submitted listing when guest posting is enabled. The vulnerability is due to a lack of proper ownership verification, which can be exploited by unauthenticated attackers to manipulate guest-submitted listings. Defenders should assess exposure and verify ownership verification of guest-submitted listings.

Defensive priority

Assess exposure of WordPress installations using GeoDirectory plugin version prior to 2.8.194

Recommended defensive actions

• Assess exposure of WordPress installations using GeoDirectory plugin version prior to 2.8.194
• Verify ownership verification of guest-submitted listings in GeoDirectory plugin
• Update GeoDirectory plugin to version 2.8.194 or later if guest posting is enabled
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE record and NVD entry provide limited information about the vulnerability. Further verification is required to determine the scope of affected systems and remediation steps. The CVE Program and NVD records indicate that the GeoDirectory WordPress plugin before 2.8.194 is vulnerable. However, the records do not provide detailed information on the exploitation of this vulnerability or the number of affected systems. Defenders should verify the ownership verification of guest-submitted listings and assess exposure.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.