GeoDirectory CVE-2026-42671

No authentication is required - CVSS PR:N and UI:N confirm unauthenticated exploitation against any publicly network-accessible WordPress installation running GeoDirectory through version 2.8.157. The sole prerequisite is that the GeoDirectory plugin is installed and active on the target WordPress site. Exploitation is bounded to the plugin's own data scope (S:U): attackers can affect directory listing integrity or availability but cannot access confidential data (C:N) through this flaw alone. Exploitation is limited by the absence of confidentiality impact, meaning this vector cannot be used alone for data theft. Sites where GeoDirectory is installed but not publicly exposed (e.g., behind WordPress login or network-restricted) face substantially reduced practical risk despite the unauthenticated CVSS vector.

CVSS 6.5 medium with a fully unauthenticated network vector (AV:N/AC:L/PR:N/UI:N) indicates a straightforward remote exploitation path requiring no special setup. However, the impact profile is deliberately partial - confidentiality is unaffected (C:N), and both integrity and availability are rated Low (I:L/A:L), meaning attackers can manipulate or disrupt GeoDirectory data but cannot exfiltrate sensitive information through this vector alone. EPSS data was not included in the source intelligence, so exploitation probability cannot be quantified. There is no CISA KEV listing and no confirmed proof-of-concept exploit, placing exploitation status at unconfirmed opportunistic risk rather than active threat. The real-world priority is moderate: high for internet-exposed WordPress directory sites where unauthenticated manipulation of listings would be damaging to business operations, lower for installations behind authentication or with restricted public access. No conflicting signals exist in the provided data, but the absence of EPSS and a confirmed patched version reduces analytical confidence.

An unauthenticated attacker identifies a WordPress site running GeoDirectory through v2.8.157 via plugin fingerprinting (e.g., checking /wp-content/plugins/geodirectory/ paths) and sends a crafted HTTP POST request directly to the vulnerable plugin endpoint without supplying any authentication token or cookie. The missing authorization check allows the request to proceed, enabling the attacker to modify or delete directory listings, or trigger actions that degrade plugin availability. No public proof-of-concept code has been identified at time of analysis, but the low attack complexity (AC:L) means exploitation would be straightforward once the specific vulnerable endpoint is identified.