CVE-2026-113673: GeoDirectory < 2.8.194 - Admin+ RCE via DB Text Export
The GeoDirectory WordPress plugin before 2.8.194 does not properly escape administrator-defined text before writing it into a generated PHP file in its own folder, allowing high privilege users such as a subsite administrator on a multisite network, who cannot otherwise run code, to achieve Remote Code Execution that any unauthenticated visitor can trigger.
Affected Software
Event History
Frequently Asked Questions
Which deployments are most exposed to this issue?
GeoDirectory installations running a version before 2.8.194 are affected. WordPress multisite networks are particularly relevant because a subsite administrator can use the issue despite not normally being permitted to execute code.
What level of access does an attacker need?
An attacker needs high-privilege access to define administrator-controlled text in GeoDirectory. The described example is a multisite subsite administrator; unauthenticated visitors can trigger the resulting code only after malicious content has been written to the generated PHP file.
Can the resulting code execution be triggered without logging in?
Yes. Once the malicious PHP content has been generated, any unauthenticated visitor can trigger the remote code execution.