GeoDirectory CVE-2026-113673

Requires a high-privilege account - specifically a user able to save GeoDirectory administrator-defined text settings, such as a subsite administrator on a WordPress multisite network who is otherwise restricted from running code (PR:H). The plugin must be present at a version before 2.8.194. Once the attacker's unescaped text is written into the generated PHP file, execution can be triggered by any unauthenticated visitor (no UI, no auth at trigger time). Limiting factors: the attacker must first obtain that privileged account, so this is not remote-unauthenticated end-to-end; on a single-site install a full administrator already has code-execution capability, so the escalation value is concentrated in multisite/managed deployments where subsite admins are intentionally sandboxed. The precise setting field and generated file path are not described in the available sources.

This is a genuine but conditional server-side code-execution flaw (CWE-94) rather than a mass-exploitable internet-facing bug. The CVSS 3.1 vector (AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H, score 7.2) correctly encodes the key tension: PR:H means a high-privilege account is needed to PLANT the payload, even though the eventual trigger (per the description) is an unauthenticated visitor hitting the generated PHP file. The signals are internally consistent and point to moderate priority: EPSS is low (0.29%, 20th percentile), the issue is NOT listed in CISA KEV (no active exploitation claimed), and only an unverified PoC reference (WPScan advisory) exists - not confirmed working exploit code. The vuln.today decision label is 'this_week', i.e. patch promptly but it is not an emergency. The practical significance is a privilege-boundary bypass: on a WordPress multisite, a subsite administrator who is deliberately prevented from running code can escalate to full RCE on the host; on a standalone install a full admin already has code execution, so the real value is in multisite/managed-hosting contexts. No signals conflict here - all four decision inputs (low EPSS, no KEV, unverified PoC, 'this_week') agree this is a real-but-not-urgent, authentication-gated issue.

On a WordPress multisite, an attacker who controls a subsite administrator account saves GeoDirectory configuration text containing PHP code; because the plugin fails to escape this administrator-defined text before writing it into a generated PHP file in its own folder, the code is persisted to disk. Any subsequent unauthenticated request that causes that generated file to be included executes the attacker's code on the server. A public PoC reference exists (WPScan) but it is not verified as working exploit code.