GeoDirectory CVE-2026-16968

Exploitation requires a valid WordPress session with at minimum Contributor-level privileges on a site running GeoDirectory prior to version 2.8.168. No special plugin configuration or non-default settings are required beyond GeoDirectory being installed and active. On sites with open user registration, an unauthenticated attacker can self-register a Contributor or Subscriber account, effectively reducing the authentication barrier to near zero. Limiting factors: unauthenticated visitors cannot exploit this flaw; the vulnerability is read-only with no write or execution path; and sites with disabled user registration and a small, trusted user base significantly restrict the attacker population. The exposed data is email addresses only - no password hashes, tokens, or other credentials are disclosed by this handler.

The CVSS 3.1 vector AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N scores 6.5, accurately reflecting network-accessible, low-complexity exploitation requiring only Contributor-level authentication with no user interaction, resulting in high confidentiality impact but no integrity or availability loss. EPSS at 0.14% (4th percentile) is notably low relative to the CVSS score, indicating that despite publicly available exploit code confirmed by WPScan, mass exploitation has not materialized at time of analysis - a pattern consistent with vulnerabilities requiring authenticated access rather than unauthenticated network exploitation. The vulnerability is not in CISA KEV, further supporting this assessment. The real-world risk is highest on WordPress sites with open user registration, where an attacker can self-register a Contributor account at no cost, making the PR:L barrier effectively negligible. Harvested admin email addresses enable targeted phishing and credential-stuffing campaigns. No conflicting signals in the available data; CVSS and description are consistent.

An attacker registers a Contributor account on a WordPress site with open registration and GeoDirectory installed. Using the publicly available exploit code documented by WPScan, the attacker sends an authenticated request to the unguarded GeoDirectory user-search handler. The handler returns the email addresses of all registered users, including site administrators, which the attacker then uses to launch targeted phishing campaigns or credential-stuffing attacks against admin accounts.