What is the CVSS score of CVE-2026-42671?

CVE-2026-42671 has a CVSS 3.1 base score of 6.5 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L. EPSS exploitation probability: 0.0%.

GeoDirectory CVE-2026-42671

EUVD-2026-33692 MEDIUM

Missing Authorization (CWE-862)

2026-06-01 Patchstack

GHSA-w25m-xp58-ggp4

Authentication Bypass Geodirectory

6.5

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

6.5 MEDIUM

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L

Primary rating from Vendor (Patchstack) · only source for this CVE.

CVSS VectorVendor: Patchstack

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

Low

Lifecycle Timeline

Analysis Generated

Jun 01, 2026 - 17:24 vuln.today

DescriptionCVE.org

Missing Authorization vulnerability in Paolo GeoDirectory allows Exploiting Incorrectly Configured Access Control Security Levels.

This issue affects GeoDirectory: from n/a through 2.8.157.

AnalysisAI

Missing authorization in the GeoDirectory WordPress plugin (through v2.8.157) permits unauthenticated remote attackers to invoke privileged plugin operations without any credential requirement, resulting in partial integrity and availability impact on directory listings. The CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms low-complexity, network-accessible exploitation requiring no user interaction, reported by Patchstack under the 'Authentication Bypass' tag. No public exploit code or CISA KEV listing has been identified at time of analysis, placing this in a moderate-priority patch tier for any WordPress deployment running a public-facing GeoDirectory instance.

Technical ContextAI

GeoDirectory is a WordPress plugin developed by Paolo that provides business directory and listing functionality for WordPress sites. The root cause is CWE-862 (Missing Authorization), meaning the plugin executes sensitive operations without first verifying whether the requesting user holds the appropriate capability or role within WordPress's permission system. The CVSS vector AV:N/AC:L/PR:N/UI:N confirms the flaw is reachable over the network without elevated privileges and with low attack complexity. The unchanged scope (S:U) indicates impact is confined to the plugin's own authorization boundary. CPE cpe:2.3:a:paolo:geodirectory:*:*:*:*:*:*:*:* covers all plugin versions up to and including 2.8.157. The plugin likely exposes REST API or admin-ajax endpoints that fail to apply WordPress's capability-checking functions (e.g., current_user_can()) before processing privileged requests.

RemediationAI

The primary remediation is to upgrade GeoDirectory beyond version 2.8.157; consult the Patchstack advisory at https://patchstack.com/database/wordpress/plugin/geodirectory/vulnerability/wordpress-geodirectory-plugin-2-8-157-broken-access-control-vulnerability for the exact patched release version, as the specific fixed version number was not confirmed in the available source data. If immediate patching is not feasible, restrict unauthenticated access to WordPress REST API routes and admin-ajax endpoints used by GeoDirectory via web server rules (e.g., nginx location blocks or Apache mod_rewrite) - note this will break legitimate frontend listing functionality for public users and requires careful scoping. Additionally, deploying a web application firewall rule to block anomalous unauthenticated POST requests to GeoDirectory-specific endpoints can reduce exposure with lower functional impact. Patch availability per vendor advisory is indicated by the Patchstack report, but the exact fix version is not independently confirmed from the provided data.