CVE-2026-118635 in GeoDirectory Plugin
Summary
by MITRE • 10/30/2026
The The GeoDirectory – WP Business Directory Plugin and Classified Listings Directory plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 2.8.198 This is due to the software allowing users to execute an action that does not properly validate a value before running do_shortcode. This makes it possible for unauthenticated attackers to execute arbitrary shortcodes.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 10/30/2026
The GeoDirectory plugin suite, encompassing both the WP Business Directory Plugin and Classified Listings Directory functionality for WordPress, contains a critical security flaw affecting all versions up through 2.8.198. The core of this vulnerability lies in the improper validation of user-supplied input prior to its processing by the WordPress shortcode execution engine. Specifically, the software fails to adequately sanitize or validate specific parameters passed during certain actions before invoking the do_shortcode function. This architectural oversight creates a pathway for unauthenticated attackers to inject and execute arbitrary shortcodes within the context of the targeted website. The absence of rigorous input validation allows malicious actors to bypass standard security controls that typically restrict shortcode execution to authorized contexts, thereby exposing the underlying application logic to abuse by any visitor with internet access.
From a technical perspective, this flaw represents a classic case of insecure direct object reference combined with command injection via template engines, specifically mapped under CWE-94 as Improper Control of Generation of Code or Script, often referred to colloquially as code injection. The vulnerability is further categorized under CWE-74 as Injection in the context of XML-based systems if applicable, but more accurately aligns with CWE-20 for improper input validation when considering the failure to check data integrity before processing. In terms of offensive security frameworks, this behavior maps directly to MITRE ATT&CK technique T1190, which describes Exploit Public-Facing Application. The attacker leverages publicly accessible endpoints or forms within the plugin interface to submit crafted payloads that are interpreted as valid shortcode syntax by the backend PHP engine. Because the validation step is missing or insufficiently restrictive, the application treats these malicious inputs as legitimate instructions, leading to the execution of code defined in the injected shortcodes rather than simply displaying them as text.
The operational impact of this vulnerability is severe due to its unauthenticated nature and broad scope across multiple plugin versions. An attacker does not need valid credentials or a user account on the WordPress site to exploit this flaw. Once executed, arbitrary shortcodes can be used to perform a wide range of malicious activities depending on what other plugins are installed or how custom functions are registered in the theme's functions.php file. Common consequences include remote code execution if specific dangerous shortcodes like [php] from third-party security-weak plugins are present, data exfiltration by reading sensitive files via PHP wrappers such as php://filter, cross-site scripting attacks that compromise user sessions, or denial of service conditions through resource-intensive shortcode loops. The ability to execute arbitrary code effectively grants the attacker full control over the web application's runtime environment, potentially leading to complete site takeover and inclusion in botnets for further distributed attacks.
Mitigation strategies must address both immediate remediation and long-term security hygiene. The primary and most effective solution is to upgrade the GeoDirectory plugin suite to a version newer than 2.8.198 where this validation flaw has been patched by the developers. If upgrading is not immediately feasible, administrators should implement strict input filtering using WordPress sanitization functions such as sanitize_text_field or wp_unslash on any user-supplied data before it interacts with shortcode processing logic. Additionally, enabling a Web Application Firewall can provide an additional layer of defense by blocking requests that contain patterns associated with malicious shortcode injection attempts. Regular security audits and the principle of least privilege should be enforced to ensure that only necessary plugins are active, thereby reducing the attack surface available for exploitation through arbitrary code execution vectors.