CVE-2026-113674
Received Received - Intake

Unauthenticated Listing Modification in GeoDirectory WordPress Plugin

Publication date: 2026-10-24

Last updated on: 2026-10-24

Assigner: WPScan

Description
The GeoDirectory WordPress plugin before 2.8.194 does not correctly verify ownership of listings submitted by logged-out users before allowing them to be edited, allowing unauthenticated attackers to modify, unpublish, attach images to, or reassign any guest-submitted listing when guest posting is enabled.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-24
Last Modified
2026-10-24
Generated
2026-10-24
AI Q&A
2026-10-24
EPSS Evaluated
N/A
NVD
CVE-2026-113674
EUVD
EUVD-2026-109217

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
Unknown GeoDirectory 0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability affects the GeoDirectory WordPress plugin before version 2.8.194. It allows unauthenticated attackers to modify guest-submitted listings when guest posting is enabled. Attackers can edit, unpublish, attach images to, or reassign any guest-submitted listing without verifying ownership.

Detection Guidance

Check if the GeoDirectory WordPress plugin version is below 2.8.194. Log in to your WordPress admin panel, go to Plugins, and verify the installed version. If guest posting is enabled, review listings for unauthorized changes or edits.

Impact Analysis

Unauthenticated attackers could alter or remove your listings, attach unwanted images, or reassign listings to others. This could damage your website's content integrity, misrepresent your business, or disrupt operations if guest posting is enabled.

Mitigation Strategies

Update the GeoDirectory plugin to version 2.8.194 or later immediately. Disable guest posting if not required. Monitor listings for unauthorized modifications and restrict user permissions to prevent access control issues.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-113674. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart