CVE-2026-113674: GeoDirectory < 2.8.194 - Unauthenticated Guest-Submitted Listing Modification
The GeoDirectory WordPress plugin before 2.8.194 does not correctly verify ownership of listings submitted by logged-out users before allowing them to be edited, allowing unauthenticated attackers to modify, unpublish, attach images to, or reassign any guest-submitted listing when guest posting is enabled.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
GeoDirectoryto a version that resolves this vulnerability.Fixed in 2.8.194
Event History
Frequently Asked Questions
Which sites are exposed to this issue?
Sites using GeoDirectory versions before 2.8.194 are exposed if guest posting is enabled. The affected listings are those submitted by logged-out users.
What does an attacker need to exploit it?
An attacker does not need to authenticate. They need the site to allow guest posting and need to target a guest-submitted listing.
What changes could an attacker make to an affected listing?
An attacker can modify or unpublish the listing, attach images to it, or reassign it.