GeoDirectory CVE-2026-118635

Requires the GeoDirectory - WP Business Directory plugin to be installed and active at any version up to and including 2.8.198; exploitation targets a plugin action (per the references, an AJAX handler in class-geodir-ajax.php and the listings widget) that passes a value into do_shortcode() without properly validating it. Per CVSS PR:N/UI:N, no authentication and no user interaction are required, so default installations of the affected versions are exploitable remotely by unauthenticated attackers. The limiting factor is the actual impact: it is bounded by which shortcodes are registered on the specific WordPress site, since only those can be executed - the available sources do not describe a specific shortcode that yields full code execution. No non-default configuration is required beyond having the plugin active.

The CVSS 3.1 base score is 6.5 (Medium) with vector AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N, meaning remote, network-reachable, low-complexity exploitation with no privileges and no user interaction - an attractive profile because any internet-facing site running the affected plugin is reachable. However, impact is rated only Low/Low/None (not full compromise), which tempers the raw ease-of-access: the real-world effect is bounded by which WordPress shortcodes are registered on the target site, not by the shortcode-execution flaw itself. The vuln.today decision label is 'this_month' (not act_now/emergency), consistent with a notable-but-not-urgent issue. No EPSS score was provided, the CVE is NOT in CISA KEV, and no verified public exploit reference was supplied (only vendor advisory, vulnerable source lines, and the fix changeset) - so there is no evidence of active exploitation. Net: this is a genuine unauthenticated-access issue worth patching on a normal cycle rather than a drop-everything emergency; the 'RCE' tag overstates it, since the CVSS impact metrics describe only Low confidentiality and integrity effects, not confirmed arbitrary code execution. Severity above the raw CVSS would require a site to have dangerous shortcodes registered - verify per deployment.

An unauthenticated attacker sends a crafted request to the GeoDirectory AJAX action (class-geodir-ajax.php) or listings-widget path that passes an attacker-supplied value into do_shortcode() without validation, causing arbitrary WordPress shortcodes to be executed server-side. The practical effect depends on which shortcodes are registered on the target site. No public exploit code was identified at time of analysis.