CVE-2026-113674 in GeoDirectory Plugin
Summary
by MITRE • 10/24/2026
The GeoDirectory WordPress plugin before 2.8.194 does not correctly verify ownership of listings submitted by logged-out users before allowing them to be edited, allowing unauthenticated attackers to modify, unpublish, attach images to, or reassign any guest-submitted listing when guest posting is enabled.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 10/24/2026
The vulnerability identified in GeoDirectory versions prior to 2.8.194 represents a critical failure in access control mechanisms within the WordPress plugin ecosystem. This flaw specifically impacts environments where the guest posting feature is enabled, allowing individuals who are not authenticated as registered users to interact with content they have previously submitted. The core technical deficiency lies in the server-side logic that handles listing modifications; rather than strictly validating that the current requestor possesses ownership rights over a specific listing ID before processing edit requests, the application relies on insufficient checks or potentially predictable identifiers that can be manipulated by an external actor. This lack of proper object-level authorization creates a direct pathway for unauthenticated attackers to bypass security boundaries intended to isolate user-generated content from unauthorized manipulation.
From a technical perspective, this issue is classified under CWE-284, which describes Improper Access Control, and more specifically aligns with CWE-915 regarding the improper modification of dynamically controlled code or data by an actor not explicitly allowed such access. The vulnerability exploits the state transition between listing submission and approval or publication phases. When a guest submits a listing, it is assigned a unique identifier within the database. However, when subsequent API calls or HTTP requests are made to update this listing's attributes—such as changing its status from pending to published, modifying its description, attaching media files, or reassigning ownership—the backend does not adequately verify that the session token or request parameters correspond to the original submitter. This allows an attacker to iterate through potential listing IDs and apply changes without ever needing valid credentials for any user account on the platform.
The operational impact of this vulnerability is severe due to its unauthenticated nature, meaning no prior login or credential theft is required to exploit it. Attackers can modify existing guest-submitted listings to inject malicious content, such as phishing links or spam advertisements, which significantly degrades site integrity and trustworthiness for legitimate users. Furthermore, the ability to unpublish listings allows attackers to disrupt business operations by removing active ads from local businesses that rely on the platform for visibility. The capability to attach images enables the hosting of inappropriate or illegal media content, potentially exposing the website owner to legal liabilities under various jurisdictional laws regarding hosted material. Additionally, reassigning ownership can lead to account takeover scenarios where an attacker claims control over a listing and subsequently attempts to link it to their own administrative credentials, thereby escalating privileges within the WordPress environment.
This vulnerability maps directly to several techniques in the MITRE ATT&CK framework for enterprise security. It aligns with T1059 Command and Scripting Interpreter if used to execute further malicious scripts via modified content, but more accurately reflects T1486 Data Encrypted for Impact or T1491 Defacement when altering public-facing information. The exploitation method falls under T1133 External Remote Services as it leverages exposed web interfaces without authentication. In the context of WordPress specifically, this behavior is consistent with CWE-20 Improper Input Validation combined with CWE-862 Missing Authorization, highlighting a systemic failure in enforcing security policies at the application logic layer rather than just network or transport layers.
Mitigation strategies must prioritize immediate patching to version 2.8.194 or later, where these access control checks have been rigorously enforced. For organizations unable to update immediately due to compatibility constraints with other plugins, temporary workarounds include disabling the guest posting feature entirely if it is not strictly necessary for business operations. Implementing a Web Application Firewall (WAF) rule set that monitors and restricts bulk modification requests on listing endpoints can also provide a layer of defense against automated exploitation attempts. Additionally, enforcing stricter rate limiting on unauthenticated API calls related to content management can mitigate the ease with which attackers iterate through listing IDs to find vulnerable targets. Regular security audits focusing on object-level authorization checks are essential to prevent similar vulnerabilities in custom WordPress development or third-party plugin integrations.