GeoDirectory CVE-2026-113674

Exploitation requires that the GeoDirectory 'guest posting' feature is enabled, and that one or more listings were submitted by logged-out (guest) users - these are the only objects affected. The attacker needs no authentication (PR:N) and no user interaction (UI:N), and operates remotely over the network. Limiting factors: impact is confined strictly to guest-submitted listings (listings owned by registered accounts are not reachable via this flaw), guest posting is a configuration-dependent feature that may not be enabled by default, and only integrity-type actions (edit, image attach, unpublish, reassign) are possible - no data disclosure. AC:H in the vendor vector indicates conditions beyond the attacker's direct control must hold (e.g., suitable guest-submitted listings existing); the precise trigger beyond the missing ownership check is not described in the available sources.

This is a low-severity broken access control flaw (CWE-284) with a vendor-aligned CVSS of 3.7 (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N). The signals are internally consistent and all point low: EPSS is 0.19% (8th percentile), the flaw is NOT in CISA KEV, and the vuln.today decision label is 'monitor' - not act_now or emergency. The network vector with no privileges (PR:N) means any unauthenticated remote attacker can reach it, but AC:H and the fact that impact is limited to integrity of guest-submitted content only (C:N, A:N) keep real-world risk modest. There is a PoC reference (WPScan) but it is not verified as working exploit code, so POC availability should not be read as active exploitation - the two are distinct. Overall this is a genuine authorization bug worth patching on a normal cycle, not a high-urgency priority; there is no high-CVSS/low-risk mismatch here because the CVSS itself is low and every other signal agrees. Note the vector sets A:N, yet the description includes 'unpublish' actions that arguably affect availability of individual listings - a possible minor undercount, but it does not change the low overall picture.

With guest posting enabled on a GeoDirectory-powered site, an unauthenticated attacker identifies listings that were submitted by logged-out (guest) users and issues edit requests against them without any ownership check. They could then alter listing content, attach images, unpublish the listing, or reassign it. A WPScan PoC reference exists but is not verified as working exploit code.