CVE-2026-81271: WordPress GeoDirectory plugin <= 2.8.176 - Cross Site Request Forgery (CSRF) vulnerability
Unauthenticated Cross Site Request Forgery (CSRF) in GeoDirectory <= 2.8.176 versions.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
WordPress GeoDirectory pluginto a version that resolves this vulnerability.Fixed in 2.8.177
Event History
Frequently Asked Questions
Who is exposed to this issue?
WordPress sites using the GeoDirectory plugin at version 2.8.176 or earlier are affected according to the available data. The vulnerability is unauthenticated, so an attacker does not need an account on the target site.
What does an attacker need to exploit it?
The attacker must induce a user to interact with a crafted request, as indicated by the user-interaction requirement in the severity vector. The available data does not identify which user role must be targeted or which GeoDirectory action can be triggered.
Does this affect a default configuration?
The provided data does not state whether a particular GeoDirectory feature, setting, or non-default configuration is required. It only identifies affected versions as 2.8.176 and earlier.