CVE-2026-57681
Deferred Deferred - Pending Action

Subscriber Server Side Request Forgery in GeoDirectory

Publication date: 2026-07-02

Last updated on: 2026-07-02

Assigner: Patchstack

Description
Subscriber Server Side Request Forgery (SSRF) in GeoDirectory <= 2.8.161 versions.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-07-02
Last Modified
2026-07-02
Generated
2026-07-02
AI Q&A
2026-07-02
EPSS Evaluated
N/A
NVD
CVE-2026-57681
EUVD
EUVD-2026-41290

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
geodirectory geodirectory to 2.8.161 (inc)
geodirectory geodirectory 2.8.161

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-918 The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-57681 is a Server Side Request Forgery (SSRF) vulnerability found in the WordPress GeoDirectory Plugin versions up to and including 2.8.161.

This vulnerability allows an attacker to make the affected website send requests to arbitrary domains on behalf of the server.

Such forced requests can potentially expose sensitive information from other services running on the same system.

Impact Analysis

The SSRF vulnerability can be exploited by attackers to make your website perform unauthorized requests to arbitrary domains.

This can lead to exposure of sensitive information from internal services that are not normally accessible externally.

Because the vulnerability has a moderate severity score (CVSS 6.4), it poses a significant risk especially if exploited in mass campaigns targeting many websites.

Mitigation Strategies

The immediate step to mitigate this vulnerability is to update the WordPress GeoDirectory Plugin to version 2.8.162 or later, as this version contains the patch for the SSRF vulnerability.

If updating is not possible immediately, it is recommended to seek assistance from a hosting provider or web developer.

Additionally, Patchstack has provided a mitigation rule to block attacks targeting this vulnerability until the update can be applied.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-57681. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart